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V. 


Although  riot  without  criticism,  the  factor  of  safety  design  concept  has 
become  an  almost  universally  accepted  measure  of  flight  safety,  there  is, 
however,  a tendency  among  engineers  to  both  challenge  the  continued  application 
of  factors  of  safety  For  efficient  airframe  design,  and  yet  to  avoid  any 
changes  that  would  challenge  the  confidence  of  future  designs.  The  use  of 
reliability  based  concepts  will  probably  incroase  but  their  application  to 
airframe  design  may  ho  limited.  The  factor  of  safety  still  covers  many 
contingencies  arid  it  appears  at  tins  time  there  will  he  a continuing  need  for 
son*'  factor,  , 
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FOREWORD 

The  authors,  Mr.  George  E.  Muller,  Aerospace  Engineer,  and  Mr.  Clement 
J.  Schmid,  Technical  Manager,  are  located  in  the  Critetia  and  Applications 
Group,  Structural  Integrity  Branch,  Structural  Mechanics  Division,  of  the 
Air  Force  flight  Oynamics  Laboratory  (FBE),  Wright-Patterson  AFB,  Ohio 
45433.  The  work  was  accomplished  under  Project  Number  2401  "Flight  Vehicle 
Structures  and  Dynamics  Technology",  Task  Number  240101  "Structural 
Integrity  for  Military  Aerospace  Vehicles",  Work  Unit  24010104  "Structural 
Design  Criteria  Specifications  and  Design  Methods."  The  effort  was 
accomplished  during  the  time  period  January  1977  through  September  1977. 

The  basic  text  was  originally  presented  at  the  45th  meeting  of  the 
Structures  and  Materials  Panel  of  the  Advisory  Group  for  Aeronautical 
Research  and  Development  (AGARD)  in  Voss,  Norway  on  September  26,  1977. 

The  text  in  this  report  remains  essentially  unchanged.  Some  figures 
have  been  added  and  minor  clarifications  incorporated.  Corrections  of  a 
historical  nature  were  made  to  the  discussion  of  the  V-G  diagrams  near 
the  end  of  Section  II . 
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SUMMARY 


The  l.!i  fa  tor  of  safety  is  a highly  visible  airframe  design  para- 
meter. The  faetor  is  empirically  derived  and  provides  an  almost 
universally  accepted  measure  of  flight  safety.  Although  the  measure  is 
qualitative,  the  level  of  safety  provided  by  the  1.5  factor  has  become 
an  accepted  standard.  These  facts  have  developed  a tendency  among 
engineers  to  both  challenge  the  continued  application  of  the  1.5  factor 
of  safety  for  efficient  airframe  design  and  yet  avoid  any  change  that 
would  challenge  the  confidence  of  future  designs.  The  unsettled  position 
on  the  factor  of  safety  may  never  completely  stabilize  but  it  can  be 
clarified  by  reviewing  its  historical  significance. 


In  11. S.  design  practice  the  significance  of  the  1.5  factor  of 
safety  can  tie  placed  in  perspective  bv  reviewing  its  development  for 
both  military  and  civil  use.  Iho  factor  evolved  as  a compromise  opinion 
based  on  flight  operations.  The  approximate  1.5  ratio  of  ultimate  stress 
to  yield  stress  for  certain  materials  coming  into  use  during  the  same 
time  period  supported  the  decision  but  did  not  influence  the  selection  of 
tin'  1.5  factor  of  safety.  Since  the  time  of  its  selection,  variations 
and  adaptations  to  othei  aircraft  types  have  been  proposed  and  sometimes 
used.  Several  variations  and  experimental  applications  are  reviewed. 


Ihe  factor  of  safety  design  concept  has  recently  lost  some  of  its 
appeal  and  reliability  based  concepts  have  been  emphasized.  As  part  of 
its  strmturai  design  criteria  development  program,  the  Air  foree  has 
sponsored  invest  igat  ions  to  develop  re  I iahi  I i t.v  based  criteria,  three 
o!  these  investigations  and  similarities  between  the  factor  of  safety 
and  reliability  concepts  ace  reviewed.  Although  the  use  of  reliability 
based  concept-,  will  probably  increase,  their  application  to  airframe 
design  may  be  limited.  The  factor  of  saiotv  still  covers  many  contin- 
gencies ami  it  appears  at  this  time  there  will  be  a continuing  need  for 
some  farter. 
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SECTION  I 


INTRODUCTION 

From  the  beginning  of  flight  and  even  before  power  was  used  the 
concept  of  safety  was  considered.  Wilbur  Wright,  in  a letter  to  his 
father,  Bishop  Milton  Wright,  on  September  23,  1900,  wrote  the  following: 

"I  am  constructing  my  machine  to  sustain  about  five  times  my  weight 
and  am  testing  every  piece.  I think  there  is  no  possible  chance  of  its 
breaking  while  in  the  air," 

Early  designers,  researchers,  and  pilots  were  interested  in  safety 
and  were  anxious  to  establish  facts  and  information  identifying  maximum 
loads  or,  various  parts  of  the  airplane.  Wind  tunnel  measurements  made 
before  and  after  1900  were  used  principally  to  predict  airplane  performance 
rather  than  structural  strength,  but  in-flight  loads  measurements  to 
assess  strength  were  also  made  during  those  early  days.  To  this  day, 
occupant  safety  is  a primary  concern  in  designing  manned  vehicles  and 
the  "factor  of  safety"  has  become  a prominent  design  concept. 

The  historical  development  of  the  1.6  factor  of  safety  in  U.S. 
practice  is  largely  unknown,  even  among  the  engineers  who  use  the  factor 
freguentl.y.  Although  not  without  criticism,  little  if  any  thought  or 
concern  is  given  to  using  the  1.5  factor  in  day  to  day  design  applications. 
This  fact  would  seem  to  reflect  its  basic  acceptance.  This  is  not  true, 
however,  with  other  structural  design  requirements  which  are  frequently 
challenged  and  modified.  Desiqn  specifications  and  practices  are  con- 
tinuously reviewed  and  revised. 

A concerted  effc  t t.o  rationalize  airplane  design  requirements  took 
place  during  the  1930's  as  a joint  effort  between  the  Army,  Navy,  and 
Civil  Aeronautics  Administration.  The  development  of  the  1.5  factor  of 
safety  is  closely  related  to,  and  interacts  with,  this  rationalization 
effort.  The  term  rational  in  this  case  refers  to  a derived  rather  than 
an  arbitrary  requirement. 
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’hr  i npooi  onion  t*.  th.it  oyolvr.l  wo  no  t hr  iv-ailt  o t ,i  hrttt’r  umlon- 
stvHHti’Hi  ot  .K  tii.i'  aioplano  opoo.it  ions  as  thov  o»punvil  .iunimi  t hr  H.'O's 
ami  rt  t hr  uinoii-.  nanai-ntor,  whirO  i n ’ 1 worn  i’.i  ilr-  i-iM  lo.uK  ami  loa.l 
tap  ton'"..  loo  «'\.ii'i!>ir , kYtononro  I states  tn.it  itunimt  the  I'l.V  s ,1 
part irulan  'onniila  tor  i-onipiitin.il  1 hr  load  f,u  ton  r.ii'.ib i 1 i t v o'  .111 
aiol'liim'  w.is  not  iiM'it  In  i'.S.  .losi-wons.  si  nee  Hi, |ht  tests  ha*l  shown 
thi-.  t ennui  a tr  hr  unnoliablo.  : T hi-  state  o'  knowl  od«|o  at  t ha  t t ino 
provided  More  intori'ut  ion  about  t tu'  a, dual  "Mvii'w.  loads  tint!  lOuld  tu' 
ovooeted  it'  flight  than  were  known  at«out  the  parameters  used  in  the 
formula.  thoiv'eno  1 v ’ i t » m-.j  1 1 *.  o'  tm  t ivenoss.  However,  ,h  a rt".  u 1 1 of 
pent  iiuiimi  fhoht  anil  mound  to->t-,  ami  emiinooniiui  studios,  overall 
knowledge  prow  puipkly  ami  t hr  rat  ional  i.Mf  ion  of  earlier  t't’iju  i ft'iorji  t ^ 

POu ) .1  hi1  -.on h , on-. i.ln-t'.l. 

Although  r rj,  t a r.i  i dosi.ir  no.:ii  moments  ton. I ti'  i han.ir  • 1 miuont  1 v , 
thr  ! . '■  \u  tor  o'  -- a f r t v. , a-,  a.loo'r.i  ami  uppl  to. I to  dosi.jn  loads,  ha •. 
hot  plumied.  When  ,!es  i.;n  or  opera!  ion.il  proMon'1*-'  arise  or  st  r„p*  nr.; ! 
failiiii".  00.  a'',  orrtam  lOrreetive  .hamies  arr  usual  I v oa.tr  to  thr 
»lrs  1 >!n  m'i’i  t ' i..  .it  ioto. . Ira.t  0 fed  i'et  ioti  toehniijuos.  ".iuu'.u  t no  mi.  i 1 vh- 
ni.juos,  on'v  iron'iontal  ••’.aiularPs , or  operational  rest  0 u ! ion-,  ot  the 
airplane.  No  known  ot'Uial  a. ! ion  "a-,  over  boon  taken  to  iih  ooa-r  ttio 
!.•>  t.u  too  o'*  .a'otv.  thr  on!\  known  attempt  'a  .Mamie  it  would  »'a.o 
rodw.  0>*  t 'ir  1 .n  t or . wh  1 . ha-,  alwav.  boon  rated  »n  .1  relatively 
■independent  anOrr  with  rr- pm  t t.1  ottirr  de-i.in  ami  ot'orational  .riteria. 


spre ' * li  i>"  o'-rMi  1",  rrl.lt  in.;  t.>  thr  Ori-m  r*  thr  1.  ■ *.u  too  o' 
sa'rH  .10''  a!  v-  ! nonr  \ 1 . i ikr  an  ,v  m.|'i  i r.  j„  1 ro'-vrt  , ;v 

11!  ’ ! i.'at  ■' on  o'  * hr  'a.  tor  o'  -.I'rti  evo’vr.i  over  .1  pen..  I o'  t'.'o 
ami  it  i s not  an  indi-iendeii'  develop-vn!  . thr  o trr.n  t ion  o'  rmiinrrnmi 
ami  0P0r.iti0h.il  rM'eriemes  arr  doi  n' vntrd  under  -.msu  .:r.  ft  wi  t it  I r •.  Mi. it 
do  not  aifinir  to  their  histori.ii!  iriat  loio.ltip  wit1'  thr  i . 0 t.utor  ot 
’safety. 

Ihrrr  was  a • e.VsoM’.ihlo,  .1 1 t h.hnili'  not  exhaust  i\r , n'.m  '»  o'  tor  op.  n 
1 't 0r.1t mv  too  in'oor.it  ion  orl.it  it. 0 to  thr  history  of  tho  i :*  '.u  too  o' 
s.ifetv  but  t ho  1 Y wr-r  1,0  .iiiivtl'.  ootati  . irferriues  'oum  . • o>t  noatol  \ 
srvooal  oolato.t  art  lilt",  wo  tv  alro.nh  t nowri  am!  wr*o  “«M.f  ‘ a.. 11  'ablr. 
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hose  few  associated  references  that  were  found  are  related  to  the  "new" 
interest  in  rationalising  structural  safety  on  a reliability  basis.  This 
interest  began  in  the  late  1%0‘s  and  early  1%0’s.  It  is  concerned 
almost  entirely  with  replacing  the  current  1 . 5 factor  of  safety  with 
probabilistic  interpretations  of  structural  safety.  ( 'rtainly,  today's 
technology  can  better  handle  the  matheraticai  and  computational  aspects 
of 'a  Score  complex  safety  evaluation  and  "’ay  have  prompted  the  current 
interest. 

Variations  to  the  convention.1.!  factor  of  safety  and  probabilistic 
techniques  that  have  been  considered  and  used  by  the  IISAF , as  they  relate 
to  static  structural  strength,  will  ai..a  bp  reviewed  to  show  how  they 
evolved  and  are  related  to  the  1.5  factor  of  safety. 

The  history  of  the  1.5  factor  of  safety  has  already  been  documented 

by  two  of  the  people  actually  involved  with  the  formulation  of  design 
requirements  during  the  IddO's  and  IQHO's.  Mr.  A.  Ipstein  worked  for 
the  United  States  Armv  Air  Corps  Materiel  Center  from  ld?d  to  1940  and 
prepared  the  original  Air  Corps  Structures  Spec  i f ication  X-1R0.T  in  10.16. 
tie  continued  his  career  Tn  the  U.S.  aircraft  industry  working  in  the 

structural  loads  and  criteria  area  until  his  ret  i remen  t. . Mr.  1.  R.  Shan  1 oy 

worked  for  the  Civil  Aeronautics  Administration  in  the  1 ‘kill's  and  was 
knowledgeable  of  the  development  of  civil  airworthiness  rogui reinents . 
Another  source  of  civil  airworthiness  requirements,  as  they  relate  to  the 
fac  tor  of  .ifetv,  is  a history  prepared  by  the  Los  Angeles  Regional -Office 
of  the  Civil  Aeronautics  Administration.  Ihese  histories  are  given  as 
Ueteretu.es  .’  {Military}  and  .i  (Civil).  The  history  of  the  1.5  factor  of 
safety  given  in  this  paper  is  derived  almost  entirely  from  these  refer- 
ences, which  are  the  only  spec  ific  sources  known  to  the  authors. 
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periodic  revisions  and  was  replaced  in  1938  by  Part  04  of  the  Civil  Air 
Regulations,  in  keeping  with  adoption  of  the  Civil  Aeronautics  Act  of 
1938  (Reference  3a). 

The  Army  and  Navy  specified  design  load  factors  for  three  flight 
attitudes,  as  shown  in  Figure  1.  Two  of  these,  low  and  high  incidence 
(angle  of  attack)  attitudes,  were  associated  with  dive  recovery  initiation,' 
and  final  recovery  from  a pull-up  to  maximum  load  factor.  The  low  inci- 
dence dive  attitude  with  its  aft  center  of  pressure  usually  designed 
the  rear  wing  spar.  The  associated  design  load  factor,  which  was  two- 
thirds  of  the  high  incident  value,  was  based  on  a lift  coefficient  of 
one-fourth  the  maximum  lift  coefficient.  This  was  a realistic  design 
concept  at  the  .time,  considering  the  relatively  limited  speed  range  of 
the  airplanes  and  the  reduced  lift  coeffici  nt  at  the  low  incidence 
design  point.  The  range  of  speed  from  stall  to  maximum  was  sufficiently 
restricted  that  when  a high  load  factor  maneuver  was  performed  the 
airplane  would  generally  come  close  to  the  maximum  lift  coefficient. 

To  achieve  the  same  maximum  load  factor  at  low  incidence,  where  the  lift 
coefficient  was  one-fourth  the  maximum,  twice  the  speed  would  be  required. 
Such  a speed  could  not  be  achieved  and  thus,  the  reduced  factor  was 
realistic.  The  third  flight  attitude  for  which  design  load  factors  were 
specified  was  that  of  inverted  flight. 

Civil  airplane  design  load  factors  were  originally  based  upon  actual 
acceleration  measurements  during  Air  Corps  tests  in  the  early  1920‘s. 

To  avoid  establishing  categories  or  weight  classifications  for  various 
airplane  types,  the  load  factors  were  made  dependent  on  airplane  gross 
weight,  and  power  loading.  Until  1932  load  factors  were  given  in  chart 
form  using  these  two  variables.  These  load  factors  were  modified 
slightly  in  193?  for  airplanes  having  low  power  loadings.  The  require- 
ments in  Ci vi ’’  aeronautics  Bulletin  7-A  were  revised  in  1934  to  include 
certain  basic  performance  and  design  characteristics  by  using  empirical 
equations  based  on  previous  operational  practice.  Although  the  load 
factor  charts  were  known  to  neglect  important  airplane  characteristics, 
such  as  wing  loading  and  drag,  no  substantial  changes  were  made  in  the 
maneuvering  load  factors  themselves.  The  load  factor  charts  were  replaced 
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in  19.14  by  ,in  empirical  oi|ua t i on  and  tin1  tn i n j iihiiu  <lt'i;i<in  load  f actor  was 
rt'diHTd  from  4.0  to  ;!./!>  because  of  satisfactory  experience  with  large 
flying  boats  (Reference  3a). 

lho  term  "factor  of  safety"  was  recognized  in  a general  sense  hat 
various  interpretations  were  applied.  Our i m;  the  19?()'s  and  early  1 930 ' s , 
all  loads  wore  ultimate  and  airplanes  were  designed  to  load  factors  which 
varied  for  each  type  Reference  I defines  factor  of  safety  as  the  ratio 
between  ultimate  load  and  maximum  probable  load.  It  states  that  the 
least  factor  of  safety  used  for  airplanes  is  usually  ;'.0  and  that  the 
term  "factor  of  safety"  is  often  used  incorrectly  in  place  of  the  term 
"load  factor."  A nearly  identical  definition  for  factor  of  safety  was 
in  use  in  bulletin  /-A  in  19;’9,  and  its  use  may  have  been  the  result  of 
Mr,  Niles'  influence  (Reference  1).  In  a minor  sense,  terminology  was 
a problem  and  Reference  1 also  gave  definitions  for  design  load,  normal 
load,  ultimate  load,  load  factor,  and  margin  of  safety.  Similar  terms 
were  also  defined  in  the  19.14  edition  of  bulletin  7-A. 

While  writing  Air  Corps  Specification  X-180.1  in  193o,  Mr.  tpstein 
noted  the  anihiguousness  of  the  terms  "applied"  and  "design"  and  proposed 
"limit"  and  "ultimate."  The  new  terms  were  later  adopted  in  a joint, 
meeting  of  Army,  Navy,  and  Commerce  Department  representatives,  the 
forerunner  of  the  group  that  later  originated  the  Army,  Navy,  Commerce 
(ANC)  programs,  which  are  shown  in  figure  d . 1 he  accepted  terms  first 

appeared  in  the  1940  changes  to  Specification  X-1H03, 

the  first  edition  of  the  Civil  Air  Regulations,  - issued  in  19.1l>, 
included  a similar  terminology  change.  The  terms  "design"  and  "applied" 
were  replaced  by  "ultimate"  and  "yield."  both  of  the  new  terms  referred 
to  loads  required  to  he  withstood  h.y  the  structure.  The  term  "limit" 
was  also  introduced  to  specify  the  "actual"  or  "expected"  load  factor. 

The  limit  load  factor  represented  a flight  limitation  for  which  the 
airplane  was  expected  to  he  completely  airworthy  (Reference  3h). 

As  defined  in  Reference  1,  Mr.  Niles  seems  to  have  ignored  the 
maximum  maneuver  load  factor  capabilities  of  the  airplane  in  his  assess- 
ment of  the  factor  of  safety  of  P.O.  He  app.  rrntly  used  only  the  more 
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typically  achieved  maneuver  load  factors  when  assessing  the  difference 
between  actual  anti  ties i qn  loads.  There  were  no  flight  restrictions  to 
limit  maneuvers,  for  example,  to  half  the  ultimate  design  load  factor 
(to  insure  a factor  of  safety  of  '.Ml)  and  it  was  characteristic  at  the 
time  to  use  the  more  typical  (or  average)  maneuver  load  factors  as  a 
basis  for  design  regulations.  The  Civil  Aeronautics  Administration 
during  the  s no  period  specified  only  a load  factor  value  (ultimate)  in 
the  Tder  of  o.O  for  a typical  airplane.  The  implication  was  that  the 
airplane  structure  should  not  fail  before  reaching  6.0(1  in  flight.  There 
were  no  maneuver  load  limitations  specified  but  there  was  the  assumed 
factor  of  safety  of  2.0. 

during  the  1920's,  operational  flight  load  factors  began  to  increase. 
In  192V,  Reference  4 stated  that  a load  factor  of  4.5  was  sufficient  for 
stunting  based  on  flight  tests  using  a JN-4H  airplane  (Figure  3),  The 
Air  Corps,  in  flight  tests  conducted  in  191:4,  recorded  a load  factor  of 
7.rt  in  a PW-7  airplane  (Figure  4)  flown  by  dames  Doolittle.  This  factor 
was  the  highest  reached  and  occurred  during  a sharp  pull-up  at  162.5  mph 
(Reference  5).  lt.e  7 , PC  compared  to  the  theoretical  maximum  of  8. 1511 
at  max  and  a design  factor  of  8.5G.  The  7.8  load  factor  certainly 
could  not  be  considered  in  the  "maximum  probable  load"  category  when 
considering  the  factor  of  safety  definition  in  Reference  1,  but  rather 
as  an  improbably  high  load.  Similarly,  the  thought  that  airplanes  had 
an  approximate  factor  of  safety  of  2.0  was  more  of  an  opinion  which  was 
based  on  limited  operational  data  and  not  on  aerodynamic  capability. 
Pursuit  airplane  design  load  factors  were  increased  to  12  when  it  was 
realized  that  the  8.5  design  load  factor  then  in  effect  could  be  readily 
exceeded. 

In  10;’/  (Reference  6),  a Navy  F6C-4  airplane  (Figure  5)  developed  a 
load  factor  of  10.5(1  during  a pull  up  and  in  1930  (Reference  7)  a PW-9 
pursuit  airplane  (Figure  6)  reached  accelerations  up  to  9(1  during  flight 
load  test  programs.  Doth  of  these  airplanes  were  designed  to  ultimate 
load  factors  of  12(1.  However,  there  were  no  further  increases  in  pursuit 
airplane  design  load  factors  as  a result  of  these  experiences. 
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The  Army,  Navy  and  CAA  began  during  the  eany  1930's  to  rationalize 
their  design  requirements.  The  objective  was  to  relate  the  air  loads  more 
closely  to  actual  flight  conditions.  This  effort  eventually  resulted  in 
the  introduction  of  gust  loading  conditions,  airplane  speed,  the  velocity- 
acceleration  (V-G)  diagram,  and  the  use  of  aerodynamic  derivatives.  A 
number  of  the  more  significant  milestones  in  the  evolution  toward  rational 
criteria  are  described  in  Reference  ?c.  The  1.5  factor  of  safety  evolved 
from  this  rationalization  process  as  an  outgrowth  of  the  flight  test 
programs  conducted. 

The  formal  introduction  of  a factor  of  safety  of  1.5  into  Air  Corps 
requirements  occurred  in  1930  but  it  only  applied  to  establishing  design 
tail  loads.  The  HI  AD  \ handbook)  design  loads  for  the  horizontal  tails 
at  that  time  were  admittedly  arbitrary  and  insufficient  for  the  expected 
service  of  many  airplanes.  Reference  8 established  a new  method  which 
consisted  of  determining  the  steady-state  flight  path  and  speed  of  the 
airplane  with  zero  power,  assuming  a complete  range  of  angles  of  attack 
from  maximum  positive  to  maximum  negative.  The  balancing  tail  load  was 
then  computed  for  each  of  these  points.  The  balancing  tail  loads  so 
defined  were  further  adjusted  by  a velocity  factor  and  increased  50  percent 
for  design.  The  50  percent  factor  over  the  computed  load  was  termed  the 
factor  of  safety  for  material.  The  adoption  of  this  design  technique 
also  introduced  the  use  of  airplane  speed  and  aerodynamic  derivatives 
(wing  moment  coefficients)  as  requirements. 

The  flight  loads  program  reported  in  Reference  7 was  the  most 
comprehensive  undertaken  up  to  that  time  (1930).  it  was  conducted  at 
the  request  of  the  Air  Corps  to  determine  the  magnitude  and  distribution 
of  loads  over  the  wing  and  tail  surfaces  of  a PW-9  pursuit  airplane 
during  maneuvers  most  likely  to  impose  critical  loads,  The  maneuvers 
included  pull-ups,  rolls,  dives,  and  inverted  flight.  Pressure  distri- 
butions and  load  time  histories  were  recorded.  The  distributed  loads 
measured  over  the  tail  surfaces  were  two-thirds  of  the  design  loads  and 
assuming  that  the  factor  of  safety  of  ?.0  applied,  the  report  concluded 
that  the  design  load  criteria  should  be  increased.  The  same  data  in 
Reference  7 were  again  evaluated  in  Reference  9.  In  Reference  9,  the 
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Mr.  Slunlev  expressed  similar  t tuui.jht *i  in  Reference  .la . He  favored 
umiuj  a I . I'  fartor  of  safety  to  keep  the  permissible  limit  loads  rela- 
tively liiiih,  as  lompatvii  to  a factor'of  .VP.  Al'hoimh  a requirement 
rolatitii)  limit  loads  to  the  at”  once  of  porii;anenf  sot  had  not  yet  been 
written,  Mr.  Shanlev  interpreted  limit  load  at  that  time  as  not  exceeding 
vield  *;t  remit  h. 

As  .limmariaed  by  Mr,  Ipstein  in  Reference  .-V,  the  tar  tor  of  safety 
value  that  one  considered  to  apply  was  a variable  which  depended  upon  the 
sample  of  flnih*.  data  used  and  personal  judoement  as  to  the  base  to  use 
in  assessing  the  factor.  In  terms' of  actual  stremith,  there  was  no  way 
of  knowing  a true  factor  of  safety  in' view  of  the  limited  knowledge 
of  loads  and  stress  analysis.  x. 

At  this  point  in  time,  a factor  ot  safety  phi'l-osophy  had  essentially 
evolved  hut  had  not  been  form..  I i.-ed.  Airplanes  were  fly  uni  at  two- 
thirds  of  u'timate  load  factor,  permanent  set  was  not  desirable,  permis- 
sible limit  loads  should  be  as  hi  oh  as  possible,  and  a l.b  factor  was 
already  in  use  to  establish  design  tail  loads,  let,  there  was  no  formally 
established  relationship  between  desiqn  lead  factor,  maximum  aerodynamic 
maneuver  capability,  and  operational  maneuver  limits.  These  relation- 
ships would  evolve  with  the  development  of  the  V-li  diagram. 

The  concept  of  a \-u  di.mrain  that  defines  the  design  boundaries  of 
an  airplane  is  .lenerallv  attributed  to  Richard  Rhode.  Prior  to  the 
adoption  ot  this  lOncept.  the  factor  o’'  safety  had  limited  significance, 
Ine  diaaram  'i-.el*  ..pet  o>s  obvious  and  elementary  but  it  represents  a 
mayor  mi  If.tene  it.',.!"i>i  to  rational  . riteria.  Hie  Navy  Bureau  of 
Aeronaut  id  was  t be  first  to  seed  tv  this  .liaaram,  shown  in  I inure  , as 
.1  rr.jui  rent'ii  t in  1 ft.!. 

in  tin1  interest  of  establishing  stun.lurd'.'ed  desinn  reiju i reinent s 
with  the  Naw,  the  Air  ion's  had  initiated  a study  of  the  Navv  series  of 
critt'ri.i  spr..  i ficai  ions  i Reference  IP'  in  Ma v I''!;.  1 he  result  of  tliis 

study  i-.  femiii  in  Reffreine  11.  Mmh  of  the  diaurai'i's  .level opment  effort 
evolved  areund  tht>  dt'i  ini  l ion  oi  the  topper  let;  and  rioht  hand  corners 
ot  thi'  en  x »'  1 i-i’t  - . 1 he  Navv  had  spe.  i * led  founded  . enters : An  existing 
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authors  assumed  that  the  maximum  operational  loads  wore  the  specif  it'd 
ultimate  design  loads  divided  In  a ).:•  factor  of'  safety.  The  measured 
tail  loads  actual  h were  about  two  thirds  of  the  design  values  and 
helped  to  substantiate  the  l.S  assumption,  although  it  was  a weak 
assumption  in  a statistical  sense.  It  was  their  belief  that  the  require- 
ments were  based  on  “an  anticipated  load  factor  plus  a margin  of  SO  per- 
cent to  allow  for  possible  imperfect  ions  of  material,  approximations  of 
analysis  and  general  lack  of  knowledge  of  loads."  In  References  7 and  R, 
then,  we  see  two  conclusions' based  on  the  same  data,  tach  conclusion 
occurred  b.v  assuming  a different  factor  ;of  safety. 

Although  some  disagreement  and  possible  confusion  seemed  to  exist, 
it  could  have  been  worse.  Presumably,  if  the  CKO  factor  had  been  con- 
sidered the  norm,  the  KM  IV- 0 airplane  should  not  even  have  been 
'permitted  to  exceed  Ml.  If  the  highest  op,  load  factor  recorded  by  the 
PW-R  airplane  had  been  considered  and  compared  to  the  KM  design  load 
factor,  an  even  lower  1 . .M  factor  of  safety  could  have  been  assumed  when 
evaluating  the  flight  data  in  Reference  '.  Now  consider  again  the 
factor  of  safety  of  ,K0.  If  it  was  still  the  accepted  norm  as  assumed 
in  Reference  then  the  "new"  conclusion  in  Reference  that  a l.b 
factor  of  safety  prevailed  during  flight  operations,  was  not  adequately 
supported,  lho  assumed  need  for  a factor  of  safety  of  ,K0  in  19l’b  was 
just  as  valid  as  assuming  the  I.S  factor  existed  in  flight  operations  in 
H3K  Neither  value  could  be  sutMaut  iated  statist  toalty.  Clearly,  a 
change  in  thinking  had  occurred  o.s  a result  of  operational  practice  and 
available  flight  test  data. 

Mr.  (ostein  notes  m Reference  .V  that  his  thinking  followed  this 
pattern.  In  the  eat  lv  N.’O’s  a tacfo'r  of'.KO  was  considered  necessary 
as  implied  in  Re'etvnce  I bv  Ni'es.  In  the  late  H.’O's,  actual  opera- 
tional flying  01  the  newer  airplanes  were  coming  closer  to  the  ultimate 
load  factor  than  earlier  models.  Airplanes  wore  flying  up  to  two-thirds 
and  more  Of  the  ultimate  load  f,utor  and  nothing  was  happening  to  the 
structure;  therefore,  the  evolution  of  thinking  toward  a lower  t.utor  of 
safety  was  a natural  one. 
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Air  Corps  requirement  tolled  for  the  ru \ 1 mum  load  f.u  tor  to  occur  at 
maximum  lift  roof' fir  ient  and  it  was  t tirrrtoro  rn  onririuioil  that  the  maxi- 
mum accolrra:  i,,>t  .i,h!  a •.  1 : :i  toeiiiiirn;  lino  ran:1  tin*  u(.(>,*r  loft 

hand  lornrr.  -hf.  point  w,i-.  adopted.  h>r  ion-,  i s tencv , the  lower  left 
corner  was  ante  ttie  intersection  of  t tu*  negative  maximum  lift  coefficient 
line  ami  ttie  negative  design  load  factor,  Ihe  Air1  Corps  also  recommended 
that  ttio  upper  right  hand  tornor  t>e  a right  angle  to  provn.r  a definitive 
low  angle  of  attack  design  point. 


!o  counter  the  argument  that  airplanes  performed  sat  is  far tori  1 y in 
service  with  reduced  load  factors  t'or  this  low  incidence  (angle  of  attack) 
corner,  Mr.  Lpstein  noted  that  stress  analysis  was  in!,,  cent  lv  conservative 
and  the  structure  was  actualh  stronger  than  analysis  indicated,  further 
evidence  to  jiMi'A  a right  angled  upper  right  hand  corner  was  provided 
hv  data  in  I’et'eience  I.'  where  a I'  l.'C  figure  A'  airplane  was  shown  to 
have  initiated  a pull  up  from  a vertical  dive,  starting  at  .’!h1  miles  per 
hour.  A max  imr  speed  of  .''>•>  miles  per  Pour  was  reached  and  a maxi  mum 
load  f.ii  tor  of  S.!>  was  developed  tat  low  angle  of  attack'  at  .'-IS  miles 
per  hour , whim  k<\  only  a slight  reduction  from  ttie  maximum  speed. 

Maximum  speed*,  were  alreadv  defined  tor  design  purposes  as  either 
the  terminal  vrloiitv  i".  a vertical  dive,  which  was  applicable  tor  pur- 
suit airplanes,  or  as  a restricted  speed  given  in  a percentage  of  high 
speed.  1 ht’sr  speed  det  nut  ions  were  also  use1  to  tori"  the  maximum 
speed  itne  *ei  ' lie  \-l!  diagram.  Ihe  in'per  and  lower  right  hard  corners 
were  triullv  adopted  a-  right  angle  « i er  ,ei  t ion*,  ot  ttie  maximum  speed 
line  i".i  Pr  "a ' 1 : ■ r:  p.-.i'ivo  and  negative  a. . elerat  ion  lines.  With  the 
adopt  ion  of  ('•••  \ ,1  .ii.igr  ni.  fv  tail  iopi  • egu  - n - * at  > of  Reference  >> 
t'e,  ,ii  •»'  obsolete  be  use  ,n  rpl.  >>v.  *rre  fen  required  to  tv  balanced  for 
all  ; o ip t s o'  ' hr  .nugra.;. 


liv  '.axuiu."  design  load  la.  tor  ivundarv  ot  the  V ii  diagram  had  in 
ossein  e al-vag-.  Peru  esi.ihi  i-.ned.  I hr  precedent  not  to  design  to  the 
max  i mi.'"  re.  erde.1  load  * .u  Vors  ef  an  airplane  Had  alrea.h  been  established 
in  tle'rren.r  •>.  whi.ts  state-,  fiat,  "If  'he  attemptHs  made  to  design 
present  servi.e  pursuit  .ti'vlunrs  to  take  « .»•■•■  ot  the  highest  a.i  elerat  ions 
.o  hir  ob.."i  vr  d,  and  still  iv’ain  a ’a,  tor  o'  o'ef.  of  l.S,  the 
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ultimate  design  load  factor  would  have  to  ho  raised  to  15.75."  This  high 
factor  was  felt  to  ho  unwarranted  by  virtue  of  the  accompanying  weight 
increase  and  loss  in  performance.  Therefore,  the  principle  of  not 
designing  to  the  maximum  recorded  load  factors  was  recognized  and  the 
maximum  load  factor  boundary  for  the  V-G  diagram  was  established  by  the 
load  factors  then  in  use. 

Having  agreed  on  the  boundary  of  the  V-G  diagram,  the  question  of 
how  to  use  the  diagram  in  conjunction  with  the  factor  of  safety  as  a 
design  and  operational  boundary  remained  to  be  resolved.  The  Army  and 
Navy  differed  in  opinion  as  to  whether  the  V-G  diagram  should  be  an 
ultimate  or  a limit  diaqram.  The  Navy  V-G  diagram  represented  an  elastic 
limit  requirement.  Yet  the  limit  was  difficult  to  define  because  the 
Navy  did  not  have  a fixed  factor  of  safety.  Appendix  II  of  Navy  Specifi- 
cation SS-1  (Reference  10)  states  that  the  ratios  of  ultimate  strength 
to  elastic  limit  strength  should  he  equal  to  or  greater  than  1.35  for 
all  conditions  except  the  dive,  in  which  case  the  factor  is  to  be  a 
minimum  of  1.5.  Wing  cells  were  to  be  designed  to  any  point  within  the 
V-G  diagram  without  exceeding  the  elastic  limit  of  any  structural 
member  and  the  horizontal  tail  had  to  sustain  the  maximum  balancing  load 
multiplied  by  1.5  without,  permanent  set,  and  by  2.0  without  failure. 

The  Navy  also  had  a flight  V-G  diagram  and  a requirement  that  the  flight 
loads  should  not  exceed  the  elastic  limit  of  the  structure.  Appendix  II 
suggested  a factor  of  1.05  or  1.10  as  the  flight  elastic  true  (yield) 
factor  of  safety. 

I he  Air  Corps  study  in  Reference  11  recommended  the  adoption  of  a 
single  factor  of  safety  as  a preferable  alternative  to  the  variety 
specified  by  the  Navy.  Since  an  Air  Corps  precedent  for  using  a 1.5 
factor  of  safety  had  already  been  established,  it  was  recommended  that 
the  1.5  factor  he  adopted  for  the  V-G  diagram.  However,  the  Air  Corps 
also  recommended  that-  the  V-G  diagram  he  an  ultimate  rather  than  a yield 
diagram  as  the  Navy  had  been  using  it.  The  Air  Corps  proposed  flight 
limits  were  to  be  two-thirds  of  the  ultimate  factors  shown  by  the 
diagram, 
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Figure  8.  Boeing  P-12C  Airplane 
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STRESS  ANALYSIS  CRITERIA 

BASH:  FLIGHT  CRITERIA 
WINGS  AN1>  WING  BRACING 
AI.  I GUT  INC  GEAR 

CONTROL  SURFACES,  INCLUDING  FIXED  SURFACES,  AND  AUXILIARY  DEVICES 

CONTROL  SYSTEMS 

ENGINE  MO.INTS  AND  NACELLES 

FUSELAGE  AND  HULL 

FITTINGS 

Figure  9.  Specification  X-1803  Classifications 
(Reference  2c). 

Tlie  Aeronautics  Bulletin  No.  7-A  retained  the  previously  described 
factor  of  safety  philosophy  and  the  implied  value  of  2.0  until  1933.  The 
1934  revision  involved  a correlation  of  loading  conditions  with  actual 
flight  conditions  and  it  was  necessary  to  redefine  the  design  or  "ultimate" 
load  factor.  An  "expected"  or  "actual"  load  factor  was  defined  in  con- 
junction with  the  ultimate  load  factor  and  a factor  of  safety.  The 
ultimate  load  factor  was  divided  by  the  factor  of  safety  to  obtain  an 
"applied"  load  factor  which  was  not  allowed  to  cause  any  permanent  struc- 
tural deformation.  The  actual  strength  requirement  in  the  1934  issue  of 
Bulletin  7-A  statu  that.  "The  minimum  factor  of  safety  for  any  aircraft 
structure  or  component  therefore  shall  he  l.!>0  unless  otherwise  specified. 
This  requires  that  ♦he  ultimate  strength  of  any  member  shall  be  at  least 
l.M)  times  as  great  as  its  critical  applied  load"  (Reference  3h). 

Over  the  years,  some  writers  have  attributed  the  origin  of  the 
].!>  t.utor  of  safety  to  the  characterist its  of  the  newer  2024  aluminum 
(24 SI  at  that  time).  It  had  a ratio  of  ultimate  to  yield  stress  of 
approximately  l.b.  Actually,  the  precedent  of  a l.!>  factor  ot  safety 
(for  design  tail  loads)  had  already  been  established  when  the  Air  Corps 
formally  adopted  it  for  overall  structural  design.  Mr.  ipstein  has 
stated  in  Reference  that  material  properties  were  not  an  Air  Corps 
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This  design  philosophy  was  incorporated  into  Revision  6 of  the  HIAO, 
dated  March  1934  and  the  1.5  factor  of  safety  became  a formal  Air  Corps 
requirement.  The  use  of  an  ultimate  V-G  diagram  was  later  changed  by 
the  Air  Corps  to  a design  load  factor  diagram  in  August,  1936,  when 
Specification  X-1803  was  issued.  The  original  recommendation  of  an 
ultimate  diagram  was  based  on  potential  structural  problems  due  to 
secondary  wing  bending  effects  in  biplanes.  By  1936  the  rapid  trend 
toward  unbraced  monoplanes  replacing  both  biplanes  and  braced  monoplanes 
in  Air  Corps  procurement  caused  the  original  concern  to  disappear. 

The  original  concern  that  led  to  the  ultimate  V-G  diagram  recom- 
mendation was  related  to  the  secondary  nonlinear  bending  load  effects 
with  load  factors  found  in  the  wing  spars  of  biplanes  and  braced  mono- 
planes. An  explanation  of  this  concern  is  given  in  Reference  1 and 
relates  to  a DH-4  wing  test  as  reported  in  McCook  Field  Serial  Report 
2391.  The  report  concluded  that  wing  spars  should  have  sufficient 
lateral  bending  strength  to  prevent  a tendency  to  twist  under  some  wing 
loading  conditions.  To  prevent  lateral  spar  failure,  the  strength 
requirement  for  the  internal  wing  drag  truss  was  increased  33  percent. 

The  Navy  engineers  disagreed  with  those  of  the  Army  regarding  the  need 
for  the  additional  factors  and  did  not  adopt  them. 

When  Specification  X-1803  was  issued,  this  and  additional  drag  truss 
design  requirements  were  given  as  part  of  the  Wings  and  Wing  Bracing 
classification  (Figure  9).  To  insure  torsional  rigidity,  the  design 
requirements  for  internal  wing  truss  designs  were  increased  as  a function 
of  the  wing  type  and  ranged  from  a factor  of  1.33  to  3.0.  These  factors 
were  used  in  addition  to  the  1.5  factor  of  safety.  However,  as  previously 
noted,  the  1936  change  from  an  ultimate  to  a limit  V-G  diagram  was 
solely  the  result  of  new  airplane  design  trends.  The  change  did  facili- 
tate the  use  of  one  diagra  for  both  design  and  operation,  but  the 
desirability  of  a single  diagram  was  already  apparent  when  Reference  11 
was  prepared.  Consequently,  the  1934  Air  Corps  recommendation  to  use  an 
ultimate  V-G  diagram  was  only  reluctantly  proposed  because  of  the 
potential  structural  bending  problems  in  biplane  wings. 
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coincidental  association  with  material  properties)  in  that  its  adoption 
in  conjunction  with  the  use  of  the  V-G  diagram  recognized  "the  principle 
of  an  airplane  being  limited  operationally  to  a flight  envelope  within 
which  it  would  not  experience  any  significant  permanent  set." 

He  further  notes  in  Reference  2c  that,  "the  factor  of  safety  of  1.5 
has  withstood  many  moves  to  alter  it,  but.  there  was  a period  in  1939 
when  the  Chief  of  the  Structures  Branch  of  the  Engineering  Division  at 
Wright  Field  thought,  seriously  of  reducing  the  value  of  the  factor. 

Newer  aluminum  alloys  were  becoming  available  with  higher  ratios  of  yield 
to  ultimate  strength  and  he  interpreted  the  factor  as  the  ratio  of 
ultimate  to  yield.  However,  no  action  was  taken  when  the  following 
explanation  was  offered:  'The  factor  of  safety  Is  not  a ratio  of  ultimate 
to  yield  strength,  but  is  tied  in  with  the  many  uncertainties  in  airplane 
design,  such  as  fatigue,  inaccuracies  in  stress  analysis,  and  variations 
of  material  gages  from  nominal  values.  It.  might  also  be  considered  to 
provide  an  additional  margin  of  strength  for  an  airplane  subjected  to 
shellfire.'" 

Finally,  Mr.  Epstein  notes  in  Reference  la  that,  "In  subsequent 
years  there  have  been  various  assessments  made  as  to  the  significance  of 
the  1.5  factor  of  safety  but  actually  its  origin  (in  USAF  requirements) 
was  an  opinion  of'  what  was  representative  of  service  flight  operations" 
(relative  to  design  load  factors). 

The  1.5  factor  of  safety  remains  today  in  an  intermittent  state  of 
assessment.  Its  use  in  U.S.  airplane  design  practice  has  never  been 
formally  designated  as  a fixed  design  entity  or  as  a single  design 
entity,  although  it.  is  often  viewed  in  that,  sense.  Other  important 
structural  design  factors  affect  safety  but  they  are  normally  viewed  in 
a less  rigid  fashion.  Each  factor  that  lias  evolved  is  applied  in  a 
specific  way.  The  1.5  factor  applies  to  the  basic  external  ground  and 
flight  loads  while  other  supplemental  factors  apply,  for  examplp,  to 
pressurized  cabins,  castings,  and  fittings.  The  size  of  the  safety 
factors  selected  usually  depend  on  the  design  application,  manufacturing 
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consideration.  If  they  had  been,  17SI,  which  was  the  aluminum  alloy 
used  at.  the  t ime,  would  have  dictated  a factor  of  safety  of  1.7,  since 
it  had  an  ultimate  value  of  55,000  psi  and  a yield  value  of  3?, 000  psi. 

The  correspond i mi  value  of  4130  steel  which  was  widely  used  at  the  time 
is  1.1’.  The  1.5  ratio  for  the  newer  aluminum,  although  not  a direct 
influence  on  the  decision  to  use  a 1.5  value,  did  support  the  selection. 

There  were  also  opinions,  as  noted  by  Mr.  Shanley  in  Reference  3a, 
which  attempted  to  relate  airplane  operation  and  permanent  set  of  the 
structure,  or  a lack  of  it.,  to  the  selection  of  the  1.5  factor  of  safety. 
This  is  often  cited  as  t he  basic  reason  for  the  choice  of  1.5  rather  than 
some  other  number.  The  approximate  1.5  ultimate  to  yield  stress  ratios 
of  commonly  used  materials  and  the  apparent  lack  of  permanent  deformation 
appeared  to  mean  that  airplanes  had  not  been  developing  more  than  about 
two-thirds  of  their  design  load  factor  in  flight.  Mr.  Shanley  points 
out  that  lie  was  not  convinced  that,  the  permanent  set  philosophy  was  a 
"sound  argument,  for  at.  least  two  reasons:  (1)  It  did  not  apply  to 
compression  members  that  failed  by  buckling,  and  (?)  tension  members 
were  almost  always  critical  at  joints,  for  which  the  efficiency  was 
generally  below  80  percent."  As  previously  cited,  Mr.  Shanley' s main 
reason  for  favoring  a 1.5  factor  was  to  allow  limit  loads  to  remain 
relatively  high  (as  opposed  to  the  assumed  factor  of  safety  of  2.0). 

Since  he  also  interpreted  limit  load  as  a requirement  to  preclude 
permanent  set  during  normal  operations,  lie  concluded  that  the  only 
significance  to  be  placed  on  the  two-thirds  ratio  was  that  it  imposed 
no  penalty  on  existing  airplanes  when  working  backward  from  existing 
load  factors,  using  a factor  of  safety  of  1.5. 

From  the  point,  of  view  of  the  Air  Force,  the  history  of  the  1.5 
factor  of  safety  can  best  be  summarized  by  several  of  Mr.  Epstein's 
observations,  lu  Reference  2a,  Mr.  fpstein  noted  that  the  decision  by 
the  Air  Corps  to  stipulate  a 1.5  factor  for  subsequent  design  in  conjunc- 
tion with  the  V-C  diagram  was  supported  by,  and  not  the  result,  of,  the 
fact  that  the  ?4ST  aluminum  alloy  material  then  coming  into  use  had  a 
1.5  ratio  between  ultimate  tensile  ami  yield  strength,  lie  felt  that  the 
adoption  of  the  1.5  factor  of  safety  was  much  more  significant  (than  any 
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SEC f I ON  III 

DEVELOPMENT  OF  OTHER  FACTORS  OF  SAFETY 

As  seen  in  the  previous  section,  the  1.5  factor  of  safety  did  not 

evolve  as  (he  result,  of  a concerted  effort  to  derive  a useful  factor. 

It  evolved  together  with  other  design  requirements  as  part  of  an  overall 

desire  to  rationalize  structural  design  criteria.  Other  commonly  used 

factors  of  safety  also  evolved  in  a similar  but  more  direct  fashion  than 
•• 

did  the  1 . 5 factor  of  safety  for  airplanes. 

The  history  of  the  1.25  factor  of  safety  for  missiles  as  a require- 
ment is  relatively  complete.  The  factor  evolved  as  part  of  an  overall 
effort  by  the  Army,  Navy,  and  Air  Force  to  develop  strength  and  rigidity 
requirements  for  missiles.  The  derivation  of  the  actual  value  of  1.25 
which  finally  evolved  is  not  as  well  defined,  however,  at  least  with 
regard  to  Wright  Field  records.  The  value  seems  to  have  evolved  through 
a philosophical  trial  and  error  process.  Missile  strength  and  rigidity 
requirements,  including  the  1.25  factor  of  safety,  were  formally  published 
by  the  Air  Force  and  the  Navy  in  Specification  M1L-M-8856  (ASG) , which 
was  dated  dune  1%9. 

Missile  design  requirements  were  actively  pursued  by  both  the  Air 
Corps  and  the  Navy  but  they  were  preceded  bv  those  of  the  pilotless 
airplane.  In  1945,  the  Air  Corps  compiled  requirements  for  such  vehicles. 
The  document,  "Stress  Analysis  Criteria  for  Winged  Missiles,"  did,  in 
effect,  apply  to  pilotless  airplanes  amt  was  derived  from  Specification 
C- 180.1- 1.’.  This  soeci f ieat  ion  retained  the  airplane  factor  of  safety 
of  ).!>.  1 hi'  Navy  wrote  a "General  speci  ficat  ion  for  the  Design  and 

Construction  of  Pilotless  Aircraft,"  in  April,  1949.  This  document  was 
referred  to  the  Aeronautical  Standards  Group  (ASG)  by  the  Navy  in 
December,  1949.  A letter  from  the  ASG  to  the  Chief  of  Ordinance 
(Pentagon),  recommended  coordinat ion  of  the  spool f icat ion  with  all 
branches  of  the  services. 
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standards,  and  the  intended  operational  use  of  the  airplane  which  existed 
at  the  time  they  were  adopted.  Since  circumstances  change,  a review  of 
the  origin  of  each  factor  is  always  of  interest  and  worthwhile.  Perhaps 
this  review  will  help  place  the  significance  and  future  applicability  of 
the  1.5  factor  of  safety  in  proper  perspective. 

The  remaining  sections  will  discuss  the  history  of  other  well 
known  factors  of  safety  and  variations  to  the  factor  of  safety  design 
concept,  from  an  Air  Force  perspective. 


Alibi  IK 

coord tiu) 1 1»"!  until  Ju)\,  l'1:':'  and  ali  act  ivmes  wore  terminated  in 
March,  H:u>.  the  romuinin.i  t r i service  coord iaui  ion  activities  were 
assigned  to  the  Navv  bureau  of  Aeronaut  ics.  1'uvctor  of  Standurdi.wl ion. 

Oiun,)v  s oonti nm'il  to  Iv  nude  to  ffu>  "final"  draft  and  several 
it. 'tat  ions  evolved  • ln.trv  dune  and  IVc ember  I’b ' drafts,  tlio  factor 
of  satotv  was  reinstated  hut  in  a di Moron!  form  than  had  boon  used 
prevtoush  *i  oho i oo  was  anon  to  tho  user.  Ho  oould  select  factors 
of  1 . 0 *v  i o 1 ii  and  1 . do  ultimate.  or  l.lu  viold  and  no  ultimate  factor. 

Win  this  oho  loo  of  factors  was  inserted  and  wl:\  tho  l.dd  was  solootod 
is  not  oloar  from  available  Air  foroo  records.-  tho  l.l'o  factor  was  a 
standard  Navv  viold  desiqn  factor  ana  ..viainullv  recommended  tor  missile 
application,  tu  tho  Navv.  as  proviousiv  stated.  I ho  l.dd  valuo  was  a 
common  factor  usod  ior  prossuro  vossol  designs,  w"ich  was  a major  design 
aspect  tor  main  missiles.  ! ho  apparont  intent  was  to  allow  roasonahlo 
design  trades  hot  worn  structural  components  which  wore  desivined  princi- 
pal 1>  tu  pressure  cons idorat ions  and  those  that  wore  not. 

A revision  to  tho  IVvt'if.vr.  las’  draft,  dated  September  l'b.'>, 
revised  that  factor  of  s.vfotv  to  1.0  for  viola  strossos  and  l..'!«  for 
ultimato  stresses.  Inis  represents  an  apparent  change  in  Navv  design 
philosoi'hv.  live  l.p  ultimate  f.u  tor  was  rot.iinod  for  huiKiling  and 
tlidh.t  launch  design  conditions,  liv  .VsVtvr,  1 draft  an.)  the  final 
published  spec i f tea! ion  retained  these  factors  which  are  still  m use. 
Although  MU  -M  b,'bp  was  published  in  final  form  as  an  Air  lorco  Navv 
spec  if icat ion , the  Armv  still  retains  an  interest  in  it  and  is  kept 
informed  unon  ev  imoik  are  made. 

i no  i ids’  interest  in.;  aspect  of  fie  «'Ksi  I'e  s-Os  it  icat  ion  is  not  the 
tern.il  intro, lew  t :on  oi  tne  'actor  o'  satotv  to  sti-.ktura!  design 
but  file  introduction  of  prohabi  1 is{  i>  drsi.jn  teihiiK)uos.  ’ho  specific,!* 
t i on  requirement  s stipulated  that  "all  , umt’inut  ions  of  loads  and  loading 
conditions  having  an  acceptable  prohub i 1 i tv  snail  tv  cons idered. " A 
specific  requirement  was  in  laded  tor  the  design  limit  incroi'vntul  oust 
response  on  a rrhahilifv  basis.  A protv. hi  1 it v of  evceedance  v.as 
stipulated  tor  the  aes i, pi  of  uirto-uir,  suri.vco  to  surface  and  surface  - 
to-.vir  missiles.  Structural  load  re- ponses  to  ..usts  were  tv’  tv  derives! 


Arnn  - 1 R- 

In  1152,  a tri -service  funded  Mi s ^ i 1 1'  Task  Group  was  formed  by  the 
Office  of  Standardizat ion.  Defense  Supply  Management  Agency.  The  task 
group  was  composed  of  five  subcommittees';  one  of  which  was  to  prepare 
structural  criteria  and  data  requirements.  This  subcommittee  first  met 
in  January,  il)5J.  The  Navy  wrote  the  first  draft  of  a guided  missile 
strength  and  rigidity  specification  for  the  Criteria  Subcommittee  in 
February,  1%3.  This  draft  specificat  ion  required  a 1.15  factor  on 
yield  strength,  a i.b  ultimate  factor  for  loading  conditions  hazardous 
to  personnel  or  to  the  launch  airplane,  and  a 1.0  ultimate  factor  for 
all  other  loading  conditions. 

The  Air  Force,  prior  to  this  time,  had  been  using  a variety  of 
ultimate  safety  factors  including  1.0,  1.15,  1.25,  1.30  for  its  winged 
arid  ballistic  missiles.  Occasionally , more  than  one  factor  was  used  on 
the  same  missile  as  occurred  on  the  Matador.  The  ultimate  factor  changed 
from  1.15  to  1.25  between  early  designs  and  the  "5"  model.  At  the  time 
the  above  Nav.v  draft  specification  was  written  (1153)  the  Air  Torce  had 
already  informally  established  the  1.25  ultimate  factor  of  safety  as  a 
standard  value  for  missiles.  This  difference  in  Air  Torce  and  Navy  factor 
of  safety  philosophy  became  very  evident  by  the  third  meeting  of  the 
Criteria  Subcommittee  anil  flu  factor  of  safety  became  the  most  contro- 
versial issue  to  be  resolved. 

1 he  matter  was  said  to  be  "resolved,"  as  noted  in  the  next  draft 
specification,  by  deleting  the  use  of  any  specific  factor  of  safety  and 
allowing  each  user  of  the  specification  to  insert  their  own  value.  This 
approach  to  the  factor  of  safety  disagreement  appeared  in  what  was  termed 
the  "final  draft"  of  the  specification  in  June,  1154.  However,  the 
actual  finalization  of  the  specification  took  considerably  longer. 

The  Army  had  initially  part icipated  with  the  Air  Force  and  Navy 
during  the  first  few  meetings  of  the  committee  but  did  not  attend  after 
October.  115J.  The  Army  Ordinance  Corps  felt  that  the  state-of-the-art 
did  not  warrant  the  issuance  of  a specification  at  that  time.  They  did, 
however,  submit  comments  on  later  drafts  when  they  were  circulated  fur 
coordination,  the  conii:i t tee's  final  draft  did  not  circulate  for  formal 
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stress.  Because  of  the  uncertainty  related  to  the  desicin  of  large, 
integral  pressure  vessels  in  combination  with  flight  loads  and  tempera- 
tures, a 1.1  factor  on  yield  was  selected  in  combination  with  a 1.4 
factor  on  ultimate.  The  study  conclusions  emphasized  that  high  safety 
factors  and  high  reliability  are  not  necessarily  equivalent,  nor  do 
they  negate  the  problems  of  inadequate  design  practice  or  analysis, 
ineffective  quality  control,  or  prevent  brittle  material  failures.  The 
yield  and  ultimate  factors  were  to  apply  to  all  combined  aerodynamic, 
inertia,  pressure,  and  thrust  loads  for  both  the  solid  and  liquid  pro- 
pellent boosters  then  being  considered.  The  liquid  booster  propellent 
tanks,  however,  when  subject  only  to  pressure  loads,  were  to  be  designed 
to  a 1.25  ultimate  factor  because  the  internal  pressures  were  considered 
more  predictable  than  those  in  a solid  propellent  booster. 

The  1.4  ultimate  factor  of  safety,  as  initially  developed,  was 
intended  for  a specific  vehicle  design,  the  X-PO  booster.  It  was  not 
intended  for  broader  gppl icut ion  or  to  he  used  without  the  1.1  factor  on 
yield  stress.  Its  use  established  a precedent,  however,  and  it  has 
since  been  quoted  in  many  publications.  Presumedly,  the  two  factors  are 
still  considered  applicable  to  current  designs,  since  they  have  appeared 
in  both  Air  Force  and  NASA  design  requirements  for  manned  sp.u. e vehicle... 

Currently,  both  missile  and  space  vehicle  structural  design  phi- 
losophies are  factor  of  safety  oriented.  However,  the  overall  design 
requirements  for  these  vehicles  are  more  closely  related  to  i reliability 
based  criteria  than  are  current  airplane  designs.  In  the  next  section, 
other  basic  concepts  which  relate  to  both  airplanes  and  missiles  will  he 
reviewed,  These  coin  epts  will  include  modifications  to  the  conventional 
factors  of  safety  and  certain  reliability  based  criteria  interact  ions. 
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from  the  method  found  in  NACA  TN  433.’  (Reference  13)  and  a definition  of 
the  atmosphere  in  power  spectral  density  form  was  taken  from  NACA 
Report  1373  (Reference  14).  The  probabilistic  dust  requirements  replaced 
the  original  discrete  gust  requirements  found  in  early  drafts  of 
M1L-M-S8S6.  The  earlier  discrete  gust  requirements  were  patterned  after 
airplane  requirements  and  wore  vigorously  objected  to  by  the  aircraft 
industry.  The  industry  also  emphasized  the  need  for  a common  atmospheric 
description  for  the  design  of  the  structure  and  the  control  system. 
Probabilistically  defined  wind  and  gust  descriptions  were  included  in  the 
final  specification. 

In  all,  an  extended  period  of  time  was  required  to  develop,  co- 
ordinate, and  issue  the  original  MU-M-bRhb  ( ASG)  missile  specification, 
but  many  of  the  requirements  were  new  and  never  before  formally 
coordinated  between  the  Services. 

A related  side  light  is  the  development  of  the  1.4  factor  of  safety 
which  is  used  for  manned  space  vehicles,  this  factor  originated  within 
the  Aircraft  laboratory.  Wright  Air  IVvolopmeni  Center  yWAlH'l.  The 
factor  was  defined  by  the  same  office  responsible  for  a' 1 other  Air 
Force  airplane  and  missile  criteria  (Reference  lb ).  Ihe  1.4  factor  grew 
out  of  a laboratory  study  to  evaluate  the  appl icabi 1 i t v of  the  l.b 
factor  of  safety  for  large  separable  boosters  for  manned  space. vehicles . 

The  P'.na  Soar  (\-30l,  manned  maneuverable  reentry  system,  was  under 
development  at  the  time  and  the  booster  \\  Stems  were  an  integral  part  of 
tht'  development,  the  manned  glide  reentry  vehicle  was  being  designed 
by  the  T.b  factor  of  safety,  but  the  factors  applicability  to  the  booster 
was  questioned.  Ihe  laboratory  study  tonsidered  the  usual  design, 
construct  ion,  and  manufacturing  limitat  ions  and  interact  ions,  but  the 
material  prupert  tes  eroviJed  (tie  major  weighting  factor.  Ihe  ultimate 
to  yield  'stress  ratios  for  the  two  candidate  P,-n.i  soar  booster  materials 
were  nearly  identical,  to  maximize  structural  safety  and  efficiency, 
the  material  , haracterist i\  s were  re.  tewed  and  safety  factors  were 
"ihosen  to  bring  the  design  working  sires'  > loser  to  t bo  design  yield 
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their  influence  on  current  design  practice.  These  variations  to  current 
factor  of  safety  design  concepts  tend  to  blend  with  reliability-based 
concepts.  One  effectively  leads  to  the  other  because  some  of  the 
variations  are  an  attempt  to  rationalize  criteria  and  are  intended  to  be 
a step  toward  a reliability-based  criteria. 

The  operational  environment  has  become  increasingly  hostile  and  more 
and  more  demands  are  made  of  the  airframe.  To  improve  airplane  performance 
and  accurately  appraise  structural  design  requirements,  established 
criteria  must  be  iontinuously  updated  and  supported  by  adequate  technology. 
The  technical  support  must  include  analytical  techniques  for  determining 
aerodynamic  derivatives,  vehicle  dynamics,  heat  transfer,  stress- 
temperature  distributions,  material  properties  after  prior  random 
exposures,  a suitable  means  of  qualifying  a structure  to  actual  or 
reasonably  representative  environments,  and  a satisfactory  means  of 
flight  test  demonstration.  Regardless  of  the  design  conceit,  the 
parameters  that  aifect  the  structure  and  its  response  must  be  further 
explored.  A realistic  appraisal  of  our  current  ability  to  guarantee 
the  design  of  a reliable  structure  and  to  define  the  steps  required  to 
obtain  a reasonable  assurance  "of  structural  reliability  is  also  required 
(Reference  16'. 

Statistics  have  formed  a basic  part  of  airplane  criteria  from  the 
time  that  sufficient  data  were  available  to  judge  the  reasonableness  of 
values  used  for  maneuver  load  factor  and  design  gust  (Reference  16); 
Material  properties,  sink  sneeds,  and  other  parameters  used  for  es t i - 
mating  fatigue  life  are  also  derived  statistically.  However,  all  current 
requirements  fot  static  strength  call  for  a spec i f i c factor  of  safety  to 
be  applied  to  maximum  expected  loads  even  though  some  of  the  design 
parameters  and  resulting  loads  were  statistical  1 y derived. 

For  about  two  decades,  which  span  the  1 'ISO's  and  1%0's,  two 
additional  design  concepts,  "safe  life"  and  'fail-safe,"  have  been  used 
in  combination  with  the  factor  of  safety  to  design  military  airplanes 
for  the  fatigue  or  repeated  load  environment.  Chief  emphasis  has  been 
placed  on  the  factor  of  safety  and  safe -life 'approaches.  The  fail-safe 
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SECTION  IV 

FACTOR  Or  SAFETY  DESIGN  CONCEPTS 

The  desire  to  rationalize  design  criteria  has  never  ceased.  Structural 
design  requirements  {military  specifications,  for  example)  are  in  a 
constant  process  of  review  and  revision.  Because  of  its  encompassing 
influence  on  structural  design,  the  factor  of  safety  has  received 
considerable  attention  in  recent  years.  This  attention,  though,  relates 
primarily  to  the  factor  of  safety  as  e design  concept.  The  specific 
value  of  the  factor  of  safety  is  usually  a secondary  consideration.  The 
actual  value  does  not  readily  equate  to  a specific  level  of  safety  and  it 
is  difficult  to  judge  the  difference  in  safety  as  related  by  a change  in 
factor  from  1.5  to  1.4,  for  example.  Similarly,  the  factor  of  safety 
concept  does  not  readily  equate  to  an  identifiable  design  objective  that 
provides  or  defines  structural  integrity.  Integrity  is  achieved  through 
many  interacting  design  facets,  some  of  which  are  obvious  and  some 
abstract.  The  concept  primarily  provides  a safe  operating  margin  between 
an  operational  and  design  level  of  strength.  Just  how  "safe"  this  margin 
makes  the  airplane  is  always  open  to  question  because  of  numerous 
unknowns  and  parameter  variations  which  affect  structural  loads,  design, 
analysis,  materials,  operation,  and  the  natural  environment.  Because  of 
these  unknowns  and  variations,  the  actual  degree  of  structural  opti- 
mization achieved  is  also  questionable.  The  apparent  high  degree  of 
structural  integrity  achieved  by  the  factor  of  safety  concept  is  often 
the  result  of  indirect,  intuitive  considerations,  and  reactions  to 
previous  problems.  Design  and  operational  experience  has  essentially 
provided  the  basis  for  the  acceptability  of  current  requirements  and 
the  safety  provided  by  the  factor  of  safety  concept.  To  overcome  this 
apparent  lack  of  precision,  definition  and  objectivity,  and  improved 
design  flexibility,  the  use  of  probabilistic  techniques  and  reliability- 
based  design  criteria  are  often  proposed. 


Having  reviewed  the  history  of  several  well  known  factors  of  safety 
for  airplane  and  missile  desuit  in  Section  II  and  111,  wo  can  now  review 
a number  ot  Air  Force  studies  of  variations  to  these  factors  and  note 
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concept  is  added  to  a design  when  high  reliability  is  required  (as  in 
transport  airplanes)  or  when  performance  penalties  are  not  incurred  (as 
in  fighter  airplanes).  The  safe-life  concept  attempts  to  identify, 
through  analysis  and  test,  the  fatigue  critical  areas  of  the  airframe 
and  offset  problems  which  might  occur  within  the  specified  lifetime  of 
the  airplane.  This  presents  a conflict  between  the  nonprobabil istic 
factor  of  safety  concept  and  the  probabilistic  concept  of  safe  service 
life.  Faced  with  an  increasingly  complex  operating  environment  and  a 
demand  for  more  reliable  (economical)  airframes,  the  designer  has 
attempted  to  make  the  most  of  each  concept.  The  factor  of  safety,  a 
static  strength  parameter,  will  not  provide  for  time  varying  effects, 
and  the  safe-life  concept  suffers  from  a lack  of  appropriate  operational 
and  structural  component  test  data.  Therefore,  the  task  of  designing  a 
reliable  structure  has  been  to  incorporate  analysis  methods  which 
combine  the  useful  functions  of  each  concept  (Reference  17). 

More  recently  the  term  of  "safe-life"  has  become  obsolete  end  the 
terms  "damage  tolerance"  and  "durability"  have  been  introduced  The 
design  intent  to  provide  structures  that  are  safe  and  economical  to 
maintain  has  not  changed  but  the  approach  is  different.  The  current 
Air  Force  design  philosophy  emphasizes  both  i ie  damage  resistance  >r 
tolerance  to  manufacturing  or  service  induced  flaws  for  some  specified 
period  of  service  usage  and  the  economical  ir.a  n Lena  nee  of  the  airframe. 

The  term  damage  tolerance  is  not  new,  but  the  emphasis  on  assumed 
initial  or  service  induced  flaws  in  the  airframe  is  relatively  new.  The 
damage  tolerance  concept  is  intended  to  minim- ze  catastrophic  structura  l 
failures  due  to  the  propagation  of  undetected  flaws  in  critical  locutions 
To  contain  the  damage,  fail-safe  and  slow  crack  growth  design  concepts 
are  used.  The  fai’-safe  concept  contains  local  damage  by  use  of  multiple 
load  paths  and  tear  stoppers.  The  slow  crack  growth  concept  protects 
safety  by  not  permitting  flaws  to  grow  through  unstable  rapid  propagation 
This  is  done  through  inspections,  or  life  limiting  in  the  case  Of 
noninspei table  structure. 
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The  durability  requirements  emphasize  low  maintenance  costs  during 
the  life  of  the  airframe.  The  durability  concept  is  intended  to  minimize 
airframe  maintenance  due  to  cracks  and  related  structural  degradation. 

The  safe-life  concept  used  a factor  of  4.0  in  predicting  fatigue  life 
and  was  a combined  deterministic/probabilistic  concept.  In  essence,  the 
damage  tolerance  concept  (which  does  not  use  a directly  applied  factor) 
can  be  considered  as  deterministic  as  the  safe-life  concept  because  the 
stipulated  initial  flaws  are  in  fact,  factors  of  safety  on  time. 

The  most  argued  "advantage"  for  reducing  the  factor  of  safety  is 
the  reduction  in  airplane  weight  and  the  accompanying  increase  in 
performance.  An  impressive  discussion  in  favor  of  reducing  the  factor  of 
safety  to  save  weight  is  provided  in  Reference  18,  which  was  written  in 
1954.  The  discussion  considers  permanent  set,  allowance  ior  defects  in 
material  and  workmanship,  stiffness,  and  maneuver  load  exceedances. 

Proper  accounting  of  these  points  during  design  is  shown  to  support. a 
decrease  in  airplane  weight.  The  arguments  seem  factual  and  are  still 
current.  Some  facets  can  he  updated  to  todays  design  philosophies  and 
technology  to  further  support  the  contentions  given.  The  advantages  to 
reducing  the  factor  of  safety  are  shown  by  decreases  in  gross  weight  as 
a function  of  factor  size  and  proportionate  increases  in  performance  for 
representative  military  airplanes.  Of  special  interest  is  the  note  that 
airplanes  frequently  exceed  design  limit  load  factors  and  that  such 
factors  may  require  an  increase,  rather  than  continuing  to  count  on  the 
1.5  factor  of  safety  to  cover  such  occurrences.  The  projecled  control 
of  limit  load  factor  exceedances  by  the  re  of  entirely  automatic  flight 
control  systems  has  not  material izor  for  piloted  airplanes  but  is  quite 
common  for  missiles  and  space  craft. 

Reference  18  also  point’s 'out  the  erroneous  idea  that  the  1.5  factor 
of  safety  always  provides  an  actual  operational  level  of  strength 
50  percent  above  limit  load  factor,  structural  design  procedures  assume 
a linear  load  increase  between  limit  and  ultimate  load  when  the  1.5 
factor  of  safety  is  used.  Due  to  aerodynamic  no'nl  inearities,  some 
parts  of  the  airplane  reach  loading  conditions  greater  or  less  than 
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Any  change  in  structural  weight  is  further  reflected  as  an  even 
larger  change  in  gross  weight.  This  relationship  is  described  by  a 
weight  growth  factor  which  is  the  ratio  of  the  delta  change  in  gross 
weight  for  each  one  pound  change  in  structural  weight.  A certain  range 
or  value  of  weight  growth  factor  can  be  used  to  describe  an  airplane 
category  (transport,  fighter,  or  bomber)  but  a specific  factor  must  be 
calculated  for  each  airplane  to  be  accurate.  Although  airframe  weight 
trends  have  not  varied  significantly  in  recent  years,  weight  growth 
factors  have  been  decreasing  and  the  overall  sensitivity  of  airplane 
performance  and  operating  costs  versus  structural  weight  have  also  been 
decreasing.  The  reasons  for  the  change  in  sensitivity  are  related  to 
technological  improvements.  These  improvements  include  the  use  of  more 
efficient  materials  and  construction  techniques,  greater  aerodynamic  and 
propulsion  efficiencies,  and  higher  internal  packaging  densities. 
Conversely,  the  structural  weight  trends  (as  described  in  Reference  19) 
show  an  insensitivity  to  higher  strength  to  weight  materials  and  related 
structural  improvements.  Apparently,  increases  in  structural  efficiency 
are  offset  by  the  imposition  of  more  severe  design  and  operational 
requirements. 

The  influence  of  current  structural  design  concepts  and  packaging 
density  can  be  illustrated  by  reviewing  the  wing  content  and  structure 
of  a current  fighter  airplane.  The  installed  wing  structure  weighs 
about  1800  pounds.  The  primary  wing  bending  strength  is  derived  from 
the  upper  and  lower  wing  box  skins  which  weight  about  735  pounds.  A 
factor  of  safety  change  would  have  the  largest  impact  on  the  wing  skins 
which  comprise  about  40  percent  of  the  total  installed  wing  structural 
weight.  A large  percentage  of  the  total  wing  weight  is  composed  of  the 
flaps,  actuators,  and  seals.  These  arid  other  miscellaneous  components 
would  not  be  greatly  affected  by  a change  in  the  structural  factor  of 
safety. 

Recent  examples  or  the  factor  of  safety's  influence  on  airframe 
weight  have  resulted  from  an  unofficial  Air  Force  design  philosophy  for 
experimental  or  prototype  vehicles.  The  unofficial  philosophy  modifies 
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the  norm.il  airplane  development  cycle  which  includes  a series  of  ground 
and  flight  tests  to  validate  airframe  integrity.  Initial  flight  tests 
are  normally  restricted  to  80  percent  of  certain  design  maneuver  load 
levels,  until' ground  static  tests  are  completed  to  ultimate  load  levels. 
Flight  test  airplanes  are  normally  instrumented  and  critical  load  points 
are  closely  monitored.  Flight  and  ground  test  loads  are  then  correlated 
and  ground  tests  are  repeated,  it  necessary,  to  further  validate  the 
structure  for  the  actual  flight  loads  before  the  airplane  is  released  to 
fly  at  100  percent  of  design  limit  load.  Such  testing  is  complicated, 
expensive,  and  time  consuming.  Although  justifiable  for  an  airplane 
system,  when  structural  efficiency  must  bo  optimized,  experimental  and 
prototype  vehicles  cannot  be  as  rigorously  tested  because  of  cost  and 
time  constraints.  To  insure  egua!  flight  safety  at  100  percent  of  design 
limit  load,  without  the  extensive  testing  and  associated  delays,  the 
following  procedure  has  been  established: 

a.  The  experiment,)  1/protot.ype  airframe  or  modifications  to  existing 
airframes  are  designed  using  a 1.07b  factor  of  safety  on  loads,  which  is 
eguivalent  to  a theoretical  margin  of  safety  of  <0.?5.  The  initial 
00  percent  flight  restriction  normally  imposed  on  an  airplane  system  is 
also  eguivalent  to  a Hi. Ob  margin  of  safety. 

h.  The  experiment,) l/prototvpe  airframe  is  stress  instrumented  at 
rrit.ic.il  design  points  and  proof  tested  or  the  ground  to  110  percent 
of  design  limit  load,  to  insure  des ign/manufacturing  integrity.  The 
installed  instrumentation  is  further  monitored  in  flight  and  compared  to 
the  pri'of  load  results  as  a further  safety  check. 

If  this  design  procedure  is  used,  the  airplane  is  allowed  to  fly  at 
100  pen  on t of  design  limit  load  capabiliiy  without  an  ultimate  load 
ground  lest  and  without  reducing  overall  surety.  Actually,  the  1.07b 
factor  and  110  percent  proof  load  test  provides  a larger  ultimate/limit 
ratio  (1.7)  than  the  conventional  ratio  II. b).  Therefore',  testing  to 
lit)  percent  of  limit  load  is  less  likely  to  iause  detrimental  yielding 
of  the  airframe  than  conventional  testing  to  100  percent  of  limit  load. 
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For  the  experimental /prototype  vehicle,  the  philosophy  imposes  no  real 
penalty  because  of  its  one-of-a-kind  nature  and  flexible  mission  status. 
Two  examples  of  this  philosophy  will  be  discussed  in  the  following 
paragraphs. 

The  first  example  is  a prototype  Mach  2 fighter  airplane  design'  which 
emphasized  exceptional  maneuverability  and  typical  mission  objectives. 

This  prototype  design  was  to  be  built  and  used  as  a technology 
advancement  demonstrator;  the  design  was  completed  but  manufacturing 
plans  were  cancelled.  The  technology  objectives  have  been  rechanneled 
to  an  existing  airplane  which  will  be  modified  instead.  During  the 
design  of  the  propose  demonstrator,  a dual  airframe  comparison  was  made 
using  the  1.5  and  1.875  factors.  The  comparison  evolved  as  follows: 

a.  The  design  requirement  specified  the  use  of  a 1.375  factor  for 
flight  loads.  Computerized  design  techniques  and  a highly  detailed 
finite  element  structural  model  were  used.  The  available  design/analysis 
flexibility  allowed  the  weight  of  the  ai  'plane  and  airframe  to  be 
established  separately  foi  both  the  1.5  and  1.875  factors. 

b.  Two  we i gut  comparisons  were  then  established:  (1)  The  airplane 
gross  takeoff  weight  using  the  1.5  factor  was  26,465  pounds.  Using  the 
1.875  factor  it  weighed  27,056  pounds,  or  mi  increase  of  2.2  percent. 

(2)  The  structural  weight  using  the  1.5  factor  was  5,095  pounds.  For  the 
1.875  factor,  it  was  5,433  pounds,  or  an  increase  of  6.2  percent.  These 
weights  reflect  a design  service  life  of  12,000  hours  (a  service  life  of 
3,000  hours  and  a scatter  factor  of  4.0). 

The  weight  growth  factor  was  calculated  to  be  1.75  (pounds  gross 
weight  increase  for  each  pound  of  structural  weight),  which  is  a 
reasonable  value  for  a fighter  airplane. 

The  second  example  is  the  YF-16  prototype  airplane.  1 ho  1.375 
factor  was  apjlied  to  the  flight  lc  ds  ami  increased  the  structural 
weight  by  6.6  peicent  when  compared  to  the  1.5  factor.  The  weight 


AFFDL-TR-78-8 

increase  has  not  been  detrimental  to  its  overall  performance  and  would 
be  further  minimized  if  the  1,000  hour  design  service  life  of  the 
prototype  airplane  were  increased.  The  weight  increment  caused  by  the 
larger  factor  to  safety  would  be  partly  absorbed  by  the  weight  increase 
required  to  meet  the  service  life  requirements. 

Using  the  same  design  analogy,  a comparison  of  the  weight  increase 
required  for  different  service  lives  can  be  seen  in  another  design  study 
of  a fighter  technology  demonstrator  of  the  same  weight  class.  For  a 
1.875  factor  of  safety  and  a scatter  factor,  of  4.0,  the  airframe  delta 
weight  increased  about  25  pounds  per  1,000  hours  of  service  life. 

Because  of  the  1.875  factor,  no  additional  weight  was  required  to  achieve 
the  first  1,500  hours.  Damage  tolerance  requirements  were  not  applied 
during  this  study  but  they  would  have  further  influenced  the  airframe 
weight,  increasing  it  to  some  degree.  Similarly,  the  1.875  factor  would 
have  lessened  the  weight  sensitivity  of  the  airframe  to  these  requirements. 

If,  instead  of  increasing  the  margin  of  safety  by  25  percent,  it 
were  decreased  by  the  same  amount,  a similar  airframe  delta  weight  could 
be  expected  for  the  technology  demonstrator.  As  noted  in  Figure  10, 
which  is  based  on  the  first  example,  the  factor  of  safety  equivalent  to 
the  25  percent  margin  of  safety  reduction  is  1.125.  The  use  of  this 
"small"  factor,  when  compared  to  the  1.50  nominal  factor,  would  probably 
not  be  considered  by  a designer  even  if  a large  reduction  in  airframe 
weight  were  desired.  The  airframe  weight  reduction  shown  (6.2  percent) 
may  be  optimistic  because  the  normal  damage  tolerance/fatigue  life 
requi rements  are  not  incorporated.  A 1.25  factor  of  safety  is  perhaps 
a more  reasonable  value  to  choose  and  is  shown  for  comparison.  It  would 
provide  an  approximate  4 percent  weight  saving  and  a 16.7  percen  ; 
reduction  in  margin  of  safety.  These  percentage  weight  changes  and 
margins  of  safety  are  reasonable  and  reflect  current  jet  fighter  design 
technology  trends.  Similar  data  can  be  found  for  other  airplane  types 
in  References  18  and  20. 
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Reference  18  reflects  technology  of  the  1 950 ' s but  the  trends  are 
still  applicable.  Data  are  given  for  fighter,  bomber,  and  transport 
airplanes  and  factors  of  safety  between  1.0  and  1.5.  The  average 
structural  weight  saving  shown  for  the  three  airplane  types  using  a 
factor  of  safety  of  1.4  would  be  2.5  (±0.25)  percent  as  compared  to  a 
1.5  factor.  If  a 1.25  factor  of  safety  were  compared  to  a 1.5  factor, 
the  average  structural  weight  saving  would  be  5.0  (+0.75)  percent. 
Although  these  structural  weight  trends  are  still  current,  the  range  and 
gross  weight  trends  in  Reference  18  do  not  represent  today's  airplanes 
as  well.  The  range  increases  shown  for  the  lower  structural  weights 
assumed  a weight  growth  factor  of  seven  for  all  three  airplane  types  and 
additional  fuel  was  substituted  for  the  gross  take-off  weight  saved. 
Using  these  assumptions,  jet  fighters  are  shown,  for  example,  to  yield  a 
15  percent  range  increase  and  jet  bombers  a 5 percent  range  increase  or 
an  average  of  10  percent  for  both  airplanes.  These  range  increases  are 
based  on  a gross  take-off  weight  and  fuel  adjustment  that  averages 
15  (+3.5)  percent  when  a 1.25  factor  of  safety  is  used.  These  gross 
weight  and  fuel  adjustments  would  average  6 (+1.25)  percent  when  a 
1.40  factor  of  safety  is  used. 

The  weight  growth  factor  of  seven  and  the  substitution  of  fuel  for 
gross  weight  saved  will  give  optimistic  gross  weight  decreases  .and  range 
increases  today  since  weight  growth  factors  are  less.  Factors  in  past 
years  for  airplanes  have  ranged  from  about  five  to  ten.  The  weight 
growth  factor  for  a fighter  today  would  be  about  two  instead  of  seven 
and  for  long  range  airplanes  like  bombers  and  transports  a value  of  five 
would  be  appropriate.  To  illustrate,  the  trend  in  Reference  18  for  a 
fighter  and  a weight  growth  factor  of  7 gives  a gross  weight  savings  of 
17  percent  for  a factor  of  safety  of  1.25.  The  fighter  technology 
demonstrator  study  gives  a gross  weight  savings  of  2.4  percent  for  a 
factor  of  safety  of  1.25  and  a growth  factor  of  1.75.  For  the  same 
factors,  Reference  18  gives  a,  gross  weight  savings  of  13  percent  for  a 
bomber  as  compared  to  6 percent  in  Reference  20,  which  used  a growth 
factor  of  5.50.  These  are  only  trends,  however,  and  they  are  debatable, 
since  weight  estimating  and  the  establishment  of  weight  growth  factors 
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is  a sensitive  art.  To  establish  accurate  values,  the  factors  must  be 
based  or,  a detailed  evaluation  of  a specific  airplane  and  its  basic 
missions. 

Reference  20  presents  a simplified  but  constructive  parametric  study 
of  the  factor  of  safety.  Three  different  vehicle  types  were  selected 
and  designed  using  a range  of  ultimate  factors  of. safety.  For  comparison, 
three  other  structural  design  concepts  were  included:  the  modified  factor 
of  safety  concept  defined  in  Reference  21,  Part  I;  a yield  factor  of 
safety  concept;  and  a reliability  based  concept. 

The  conventional  factor  of  safety  was  applied  to  the  limit  design 
loads  of  each  vehicle  in  increments  between  1.0  and  2.0.  The  modified 
factor  of  safety  concept  applied  a factor  of  1.05  to  speed,  1.15  to 
maneuverability  and  1.10  to  design  loads.  A yield  philosophy  applied 
factors  of  1.0  and  1.10  to  design  limit  loads. 

The  demonstration  included  cruise,  ballistic,  and  glide  reentry  type 
vehicles.  Although  hypothetical  mission  profiles  and  performance  figures 
were  used  they  were  patterned  after  real  vehicles  and  designed  to 
realistic  structural  requirements.  The  structural  concepts  used  were 
monocoque,  semimonocoque,  truss,  pressure  stabilized,  and  sandwich 
honeycomb.  Two  structural  concepts  were  applied  to  each  vehicle,  as 
appropriate  to  the  vehicle  type,  and  radiating  and  ablative  thermal 
protection  systems  were  applied  separately  to  the  reentry  vehicle. 

The  conventional  factor  of  safety  philosophy  normally  considers 
only  one  factor  to  establish  ultimate  design  loads,  without  regarding 
the  variables  contributing  to  the  limit  loads.  The  yield  design 
philosophy  uses  a single  factor  of  safety  to  prevent  the  design  limit 
stresses  fiom  exceeding  the  material  yield  stress;  an  ultimate  load 
factor  is  not  used.  The  modified  factor  of  safety  philosophy  also 
applies  a factor  to  the  design  limit  loads  but  these  leads  are  first 
established  by  factoring  two  performance  parameters,  as  previously 
noted  K 
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A reliability  based  design  philosophy  normally  considers  the 
statistical  distribution  and  the  probability  of  the  combined  occurrence 
of  a finite  number  of  structural  design  factors  in  order  to  establish 
design  loads.  In  Reference  20,  the  various  factor  of  safety  design 
philosophies  were  also  compared  to  a structural  reliability  value.  The 
reliability  value  was  established  by  considering  the  statistical  dis- 
tributions and  the  simultaneous  occurrence  of  two  statistically  variant 
design  factors. 

The  parametric  study  considered  both  rigid  and  flexible  structure 
and  aerodynamic  heating  effects  when  applicable.  Weight,  weight  dis- 
tribution, and  stiffness  characteristics  were  determined  for  each  major 
component.  These  parameter  variations  were  correlated  to  each  vehicle's 
performance  and  structural  reliability. 

The  scope  of  the  investigation  can  be  considered  limited  in  that 
the  structural  concepts  used  were  simplified,  the  analysis  methods  were 
not  elaborate,  and  only  one  critical  design  point  was  selected  for  each 
vehicle.  However,  structural  weights  were  optimized,  the  effects  of 
plasticity  were  accounted  for,  and  interaction  equations  were  used  to 
account  for  local  and  general  instabilities  caused  by  combined  loading. 

The  vehicle  design  is  similar  to  a B- 52  bomber  in  performance,  size, 
weight,  and  structural  flexibility.  Gust  and  maneuver  were  the  critical 
design  conditions.  These  two  parameters  formed  the  loading  interaction 
curves  used  to  establish  an  equivalent  reliability  based  design,  as 
shown  in  Figure  11.  By  using  available  gust  and  maneuver  statistics, 
the  most  probable  combination  of  the  two  design  parameters  that  could 
cause  structural  failure  at  each  strength  level  were  located  on  the 
interaction  envelopes,  as  shown  in  Figure  12.  Although  not  an  optimum 
design,  considering  the  complexity  of  other  reliability  based  concepts, 
the  most  probable  failure  point  is  used  to  illustrate  that  a lighter 
structure  can  be  achieved  by  a reliability  based  concept  as  compared  to 
a factor  of  safety  concept,  even  though  both  provide  the  same 
(theoretical)  reliability. 
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The  weight  reduction  for  the  equally  reliable  design  is  achieved  by 
bringing  the  strength  of  the  individual  components  closer  together. 

This  is  similar  to  using  different  factors  of  safety  to  contour  the 
shape  of  the  interaction  curves  of  overstrength  components  to  fit  the 
shape  of  the  composite  failure  boundary  of  the  vehicle.  This  takes 
advantage  of  the  fact  emphasized  in  Reference  18  that  all  components  do 
not  reach  150  percent  of  limit  load  simultaneously.  Part  of  the  study 
results  for  the  cruise  vehicle  are  shown  in  Figure  13. 

The  range  increases  shown  in  Figure  13  are  the  result  of  decreases 
in  the  inert  (empty)  weight  of  the  vehicle.  The  ratio  of  inert  weight 
change  to  structural  weight  change  is  about  2.0  and  the  growth  factor 
between  structural  weight  change  and  gross  take-off  weight  change  is 
about  5.5.  The  decrease  in  inert  weight  due  to  the  structural  weight 
change,  for  example,  when  using  a 1.25  factor  of  safety  is  about  11 
percent,  which  increases  the  range  1.6  percent.  The  dramatic  perfor- 
mance increases  often  seen  in  such  comparisons  is  not  seen  here  because 
of  the  more  realistic  value  of  the  weight  growth  factor.  The  substi- 
tution of  fuel  for  either  the  inert  or  gross  weight  saved,  although  a 
fuel  substitution  for  inert  weight  saved  is  shown,  is  not  considered  a 
realistic  design  trade.  The  performance  of  a specific  airplane  design 
is  normally  optimized  using  available  fuel  volume;  any  additional 
structural  weight  saved  as  a result  of  a concerted  weight  reduction 
program  would  normally  enhance  the  performance  based  on  the  original 
f uo 1 vo 1 ume , i ndopenden 1 1 y o f add i t i ona 1 i'uo 1 . 

Fatigue  life  and  flutter  wete  not  design  considerations  in 
Reference  .’0  and  their  interactions  are  unknown.  Similarly,  the  proba- 
bilities shown  in  Figure  13  are  based  only  on  the  interaction  of  gust, 
and  maneuver  loads  and  do  not  consider  other  facets  smh  as  material 
properties  and  workmanship  that  would  also  affect  the  structural 
reliability. 

Hie  gross  trends  established  in  Reference  20  should  not  be  siqnifi 
eantl.v  allotted  in  the  limited  Mope  of  the  study  and  the  use  of 
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simplified  s t ruct  utv  ’ models.  As  a general  trend,  the  rel  iahi  !i  ty 
bast'd  design  concept  provided  a lower  structural  weight  and  hot  tor 
performatne  than  did  the  far t nr  of  safety  concept  having  an  ogual 
rol  tobi  1 i ty.  Tin'  modi  Cit'd  factor  of  safely  concept  gave  results  closer 
to  the  reliability  based  concept  using  two  paraim'tors  than  did  the 
single  factor  of  safety  used  to  obtain  ‘ho  ultimate  design  loads. 


theoretical ly,  a higher  confidence  can  hi'  placed  in  a structure 
designed  by  a reliability  concept  then  bv  a t act  or  ..if  safety  concept 
because  the  actual  reliability  ot  the  factor  of  safety  design  is  never 
known.  The  reliability  based  concept,  by  contrast,  considers  the 
statistical  nature  of  the  design  parameters  and  thus  acquires  a known 
reliability  and  the  associated  confidence  level  of  the  statistical  data 
used.  In  a practic.fi  sense,  hovs'vor,  this  is  not  true  because  the 
design  parameters  am  not  well  defined  and  the  aclaal  (pliability  of  the 
structure  cannot  he  auth 'tit it ated. 


The  modified  factor  of  safety  concept . as  incorporated  in  the 
comparative  factor  of  safety  study  in  Reference  .’(1,  is  documented  in 
Reference  i’l,  Pa*t  1.  The  concept  was  developed  as  an  interim  design 
method  to  he  used  until  a larger  number  of  parameters  could  be  defined 
and  a formal  reliability  based  concept  established.  In  Reference  ? 1 , 
forty -one  design  parameters  are  described  as  significant  to  a reliability 
based  structural  design  e<  ”opt.  fifteen  are  related  to  the  design 
environment  and  operating  conditions,  lho  related  analysis  parameters 
ate:  aerodynamic  forces,  propulsion  system  furies  and  pressures, 
material  properties  and  property  variations,  thermal  stresses,  creep  of 
materials,  weight  and  weight  distribution,  component  misalignments, 
construction,  propulsion  system  thrust  misalignments,  aeroelasf it  i ty 
and  aerothermoelast ii  i ty,  buffeting,  flutter,  shock  and  vibration, 
workmanship,  fatigue,  noise,  fuel  sloshing  and  sunning,  structural 
temperature,  ablation,  corrosion,  oxidation,  and  erosion. 


As  a coru  opt.  the  modified  fatter  of  safety  tan  be  applied  to  any 
vehicle  design  but  it  was  original iv  developed  tor  missile  design 
appl it  at  ion.  lho  use  ot  three  parameters  seemed  feasible  within  the 
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current  state-of-the-art  and  the  concept  is  onsidered  tc  be  more 
rational  than  the  ultimate  factor  of  safety  concept  because  it  rec- 
ognizes parameters  other  than  load  as  significantly  affecting  structural 
integrity  and  reliability.  Although  the  structural  reliability  of  a 
missile  design  using  the  1.25  factor  of  safety  could  not  be  given  a 
numerical  value,  the  reliability  seemed  high,  and  the  three  factors 
selected  (1.05  on  speed,  1,10  on  loads  or  "quality,"  and  1.15  on 
maneuverability)  were  chosen  to  give  a combined  strength  effect  similar 
to  that  provided  by  the  1.25  factor.  The  1.05  factor  on  "peed  is 
significant  because,  for  some  missiles,  small  increases  in  speed  result 
in  rapid  degradation  in  structural  capacity  due  to  material  degradation 
with  rising  temperature.  The-,  with  the  initial  design  ba-.rd  ori  a 
higher  speed  (and  hence  higher  temperature)  the  designer  is  forced  to 
avoid  the  use  of  materials  which  are  unduly  sensitive  to  temperatures. 

The  1.10  "quality"  factor  is  ap,/'ied  to  the  structural  loads  incurred  at 
specified  maximum  design  conditions  rather  than  at  conventionally  defined 
limit  conditions.  This  concept  more  rationally  accounts  for  the 
nonl ihea'-ities  in  aeroelastk  and  aerodynamic  data  that  frequently  occur 
between  limit  and  ultimate  (design)  conditions.  The  1.15  factor  is 
applied  to  She  maneuver  load  factor  to  protect  the  vehicle  from 
inadvertent  maneuver  exceedances, 

The  modified  factor  of  safety  concept  was  used  tc  design  the  ASSFT 
glide  reentry  vehicles.  ASSFT  is  an  acronym  for  Aerothern'odynamic/ 
elastic  Structural  Systems  Fnvironmental  Tests.  The  ASST!  program 
consisted  ot  designing  and  flying  a series  of  winged  glide  reentry 
vehicles  which  wore  boosted  into  suborbital  flight  paths.  I'a.h  vehicle 
was  designed  to  explore  an  area  of  glide  reentry  technology  that,  could 
not  be  defined  in  existing  ground  test  facilities.  Structural  flight 
test  results  and  date  correlations  which  substantiate  the  adequacy  of 
the  design  concept,  at.  ieast.  for  vehicles  having  a programmed  trajectory, 
is  given  in  Reference  22. 

For  an  airframe  that  is  not  aeroJynanneall.y  heated,  the  load  factor 
parameter  is  usually  suff  icier  t to  < envoy  its  overall  strength  capability 
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With  tho  introduction  of  transient  stresses  and  reduced  material 
properties  due  to  thermal  gradients  and  high  temperatures,  there  is  no 
simple  method  for  conveying  strength  capability  (Reference  23),  Although 
a thermal  factor  of  safety  is  not  necessarily  a true  factor  of  safety  in 
the  conventional  sense  it  represents  a design  concept  that  is  intended  to 
provide  an  equivalent  measure  of  conservatism  and  confidence  in  the 
heated  airframe  as  that  provided  by  the  conventional  factor  of  safety 
in  the  cold  airframe. 


To  date,  unofficial  Air  force  policy  has  been  to  avoid  using  any 
factor  on  temperature,  heat  transfer,  or  on  time  at  temperature  for 
airplanes.  This  has  been  a reasonable  policy  since  service  experience 
has  demonstrated  that  there  is  little  problem  in  keeping  within  a 
speed-altitude  design  envelope.  Thus,  in  a sense,  the  temperatures 
normally  used  for  design  represent  the  actual  maximum  to  be  expected 
for  the  structure.  This  philosophy  of  not  factoring  temperature  is  an 
apparent  contradiction  when  compared  to  the  philosophy  of  factoring 
limit  load,  which  is  also  considered  the  maximum  to  be  expected 
(Reference  16). 


The  factors  of  safety  used  in  conventional  airframe  design  to 
incorporate  conservatism  also  apply  to  aerodynamical ly  heated  airframes 
but  the  conventional  factors  do  not  account  for  the  additional  uncertainties 
associated  with  elevated  temperatures.  The  additional  conservatism 
.'■•ust  relate  directly  to  the  uncertainties  associated  with  the  prediction 
of  structural  temperatures  and  thermal -structural  design  analysis. 

However,  the  tact  that  an  airframe  nay  have  been  built  to  resist  aero- 
dynamic  healing  effects  does  not  necessarily  imply  an  increase  in  con- 
ventional design  ami  man (factoring  deficiencies.  Initially,  the  use  if 
relatively  unfamiliar  materials  and  forms  of  construction  in  the  heated 
airframe  and  the  need  for  computing  structural  temperatures  with  only 
a limited  amount  of  f light  test  information,  does  tend  tic  increase  the 
likelihood  of  doth  iem  ios.  In  time,  however,  'hese  i onsi defat  ions 
improve  and  the  modification  of  conventional  structural  satety  factors 
is  not  warranted  (Reference  ;-'•!), 
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As  part,  of  an  overall  Air  Force  effort  to  establish  a rational 
design  criterion  for  aerodynamical ly  heated  airframes,  the  velocity 
factor  has  evolved  as  a simple  and  expedient  way  of  providing  and 
controlling  thermal-structural  design  conservatism  throughout  the 
design  cycle.  The  details  of  tnis  concept  are  developed  in  Reference  24. 
The  techniques  investigated  included  factoring  structural  loads,  temper- 
ature or  heat,  flux,  angle  of  attack,  velocity,  and  atmospheric  density. 

It  concluded  that  only  factors  on  velocity  or  structural  temperature 
(or  heat  flux)  are  likely  to  provide  an  adequate  margin  when  considering 
the  exceedances  of  performance  variables.  Of  the  two  choices,  the  factor 
on  velocity  is  considered  the  more  logical.  The  velocity  factor  provides 
conservatism  in  a uniform  way  at  each  point  in  the  design  mission  as  a 
function  of  Mach  number  and  the  selected  size  of  the  velocity  factor 
controls  the  imposed  conservatism. 

A thermal  factor  of  safety  on  loads  would  introduce  an  arbitrary 
(unknown)  conservatism;  however,  a direct,  rather  than  a presumed, 
margin  of  safety  would  exist  at  the  operational  level  if  margins  were 
placed  on  performance  variables  instead.  Factoring  a performance 
parameter  (speed)  provides  conservatism  in  a way  parallel  to  that 
achieved  by  factoring  loads  and  is  preferred  to  factoring  temperature 
or  heat  flux  since  performance  margins  introduced  over  operational  levels 
are  more  evident  and  controllable. 

By  requiring  a design  speed  beyond  limit,  the  velocity  factor,  is 
in  a sense,  a factor  on  heat  transfer.  However,  to  specify  a direct 
and  specific  factor  on  heat  transfer  would  be  a design  weakness,  in  that 
a number  of  analytical  techniques  may  exist  for  a particular  area  and 
flight  regime,  with  a large  spread  in  the  values  they  provide.  From  a 
structural  point  of  view,  the  factor  of  safety  should  be  associated  with 
a particular  analytical  method.  For  ablation,  varied  factors  of  safety 
have  been  used  (generally  to  factor  the  thickness  of  the  ablator),  with 
different  considerations  being  given  to  each  particular  flight  application 
and  for  applications  of  the  material  as  an  insulator.  A factor  may 
also  be  used  to  represent  a combined  factor  on  heat  transfer  and  on 
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ttn>  scatter  of  the  ablative  material  characteristics.  Factors  of  safety 
relating  to  tnermal -structural  applications  can  only  have  meaning  when 
relat'd  to  the  trajectories  or  flight  paths  for  which  they  are  needed. 

A factor  of  safety  on  a nominal  trajectory  may  be  appreciably  higher 
than  those  corresponding  to  design  trajectories  based  on  a broad 
parametric  investigation  or  one  which  places  a margin  on  altitude  which 
represents  a factor  of  safety  on  temperature  (Reference  23). 


No  single  technique  can  be  expected  to  provide  conservatism  in  a 
rational  way  for  all  contingencies.  At  best,  one  type  of  factor  will 
come  closest  to  providing  the  desired  conservatism  and  this  has  been 
true  of  the  velocity  factor.  Its  use  seems  reasonable  in  view  of 
existing  factor  of  safety  precedents.  A specific  design  requirement 
for  aerodynamical ly  heated  airframes  is  being  formulated  and  tested  by 
design  appl ication.  The  basic  criteria  is  conventional  but  it  is 
modified  to  incorporate  the  velocity  factor  concept  and  attempts  to 
account  for  ma.iy  of  the  design  and  analysis  variables  which  affect 
thermal-structural  design.  The  criteria  have  not  been  finalized  and  are 
based  primarily  on  References  16,  23,  and  24,  which  provide  insight  to 
time  related  load  and  temperature  interactions  and  the  selection  of 
critical  thermal-structural  design  points. 


Most  of  the  studies  and  design  concepts  reviewed  in  this  section 
have  evolved  as  an  attempt  to  further  rationalize  structural  design 
criteria.  As  previously  noted,  these  variations  to  the  current  factor 
of  safety  design  concept,  tend  to  Mend  with  reliability  based  concepts. 
The  next  section  will  discuss  certain  reliability 'based  concepts 
investigated  by  the  Air  force,  related  design  parameters,  and  data 
collection  programs. 
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SECTION  V 

RELIABILITY  BASED  DESIGN  CONCEPTS 

The  number  of  publications  treating  reliability  based  design  increased 
appreciably  in  the  early  1950's.  Initially,  reliability  design  seemed 
to  imply,  at  least  within  the  Air  Force,  the  elimination  of  the  factor 
of  safety  as  a design  concept.  Statistically  defined  design  parameters 
and  parameter  interactions  were  to  be  substituted  for  the  discrete 
parameters  and  the  factor  of  safety.  Too  often,  however,  the  magnitude 
of  the  problem  was  overlooked  and  the  acquisition  of  essential  elements 
were  overly  simplified. 

The  Air  Force  initiated  the  development  of  a reliability  based 
structural  design  criteria  for  missiles  in  the  mid  1950's.  Missiles 
were  one  shot  devices  and  unmanned.  There  was  little  to  lose.  Airplanes 
in  turn,  were  to  become  mere  missile  launching  platforms  that  would  not 
require  strength  for  rigorous  design  maneuvers.  Combat  was  to  be  con- 
ducted remotely.  During  this  .swirl  of  revised  commitment  to  systems 
development,  the  Air  Force  established  a program  to  conduct  a series  of 
investigations  that  were  to  encompass  and  define  the  total  life  cycle  of 
a missile.  Considerable  priority  was  given  to  this  effort.  The 
rationalized  criteria  were  to  be  based  on  information  obtained  through 
data  gathering  programs  and  operational  experiences.  The  broad  goal 
was  to  establish  a reliability  based  structural  design  criteria  to 
replace  the  factor  of  safety  for  missiles.  This  rationalized  criteria 
was  to  be  placed  in  the  new  structural  strength  and  rigidity  specifi- 
cation MIL-M-8856,  initially  dated  22 'June  1959.  However,  the  data  base 
never  materia  1 ized,  the  1.25  factor  of  safety  is  still  used,  and  the 
emphasis  to  develop  a reliability  based  criteria  for  missiles  has 
diminished. 

When  the  need  for  a reliability  based  criteria  is  considered,  a 
comparison  is  usually  made  to  existing  design  requirements  and  the 
need  is  often  questioned:  "Why  are  reliability  based  critera  required 
when  current  requirements  and  industry  practices  have  produced  airplanes 
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having  a (seemingly)  high  reliability?"  The  answer  that  evolves  must 
in  some  way  relate  to  realism  in  design.  A reliability  based  design 
concept,  as  stressed  by  some  in  the  literature,  is  inevitable  and  is 
the  only  means  of  providing  greater  realism;  the  only  way  of  rationalizing 
the  factor  of  safety  concept. 

The  Air  Force  first  deviated  in  a significant  way  from  a deterministic 
design  concept  by  defining  probabilistic  fatigue  design  requirements. 
Although  they  were  applied  deterministically  in  the  final  analysis,  the 
realism  that  operational,  environmental,  design  and  manufacturing 
variations  preclude  the  development  of  no-failure  airframes  was  implicitly 
emphasized.  This  is  further  emphasized  in  the  later  changes  in  Air  Force 
philosophy  by  changing  from  a safe  life  concept  to  a damage  tolerant 
concept,  as  described  in  Section  IV. 

A related  change  in  design  philosophy  should  also  he  noted.  In  I960, 
in  conjunction  with  the  Navy,  the  MIL-A-8862  (ASG)  Specification, 

"Airplane  Strength  and  Rigidity,  Landing  and  Ground  Handling  Loads", 
was  established  and  incorporated  an  unfactored  design  load  concept. 

This  concept  applied  only  to  the  landing  loads  analysis.  Limit  and 
ultimate  loads  were  not  specified  for  these  conditions.  The  incentive 
to  deviate  trom  the  1.5  factor  of  safety  concept  was  the  realism 
provided  by  available  operational  statistics  of  the  type  describeo  in  - 
Reference  17.  A general  dissatisfaction  with  the  design  load  concept 
resulted  in  a change  back  to  the  use  of  a 1.5  factor  of  safety  in  the  1971 
Air  Force  revision  of  the  specification  which  became  MIL-A-00886?  (l)SAF). 
However,  the  design  load  concept  for  landing  loads  is  still  viewed 
favorably  and  is  being  used  by  the  Navy. 

The  Air  Force  only  applied  the  design  landing  load  concept  to  two 
airplanes.  On  one  airplane  the  concept  was  applied  to  the  first  two 
models;  later  models  of  the  airplane  were  changed  and  redesigned  using 
the  1.5  factor  of  safety.  Unfortunately , the  limited  application  of  the 
design  landing  load  concept  also  limit-,  the  experience  base  available 
for  evaluation.  Apparently,  there  was  very  little,  if  any,  penalty 
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involved  between  the  models  which  employed  the  two  concepts.  The  in- 
frequent application  of  the  design  load  concept  and  its  eventual 
elimination  from  M1L-A-88C?  can  bo  traced  to:  (1)  an  Air  Force  requirement 
that  transport  airplanes  be  compatible  with  and  certified  to  FAA 
requirements;  (2)  a lack  of  clarity  in  the  specifications  and  differences 
of  opinion  regarding  which  loads  are  affected  by  the  design  load  concept 
and  which  ones  are  net  (carry  through  structure,  nacelle  attachments, 
external  tank  and  store  attachments,  etc.);  (3)  difficulties  in  the 
interpretation  of  interactions  with  other  requirements  relating  to 
material  yielding  and  aeroelastic  effects;  and  (4)  the  added  difficulty 
of  applying  static  test  loads  to  the  airframe  through  the  lower  strength 
landing  gear.  The  overriding  reason  for  these  implementation  problems, 
however,  appears  to  be  poor  planning.  The  concept  was  conceived  and 
implemented  too  quickly  and  without,  appropriate  trial  applications.  No 
loss  in  design  efficiency  is  expected,  with  respect  to  static  strength 
requirements,  by  using  the  1.5  factor  of  safety.  Current  durability, 
damage  tolerance,  and  dynamic  taxi  requirements  will  add  more  weiqht 
than  could  be  saved  by  using  either  the  design  load  concept  or  the 
factor  of  safety  concept. 

Design  philosophies,  such  as  those  noted  above,  evolve  over  a period 
of  time  and  revisions  normally  follow  a series  of  trial  and  error 
applications.  Basic  philosophies  are  formally  adopted  and  maintained 
in  specifications  and  handbooks.  The  design  specifications  and  handbooks 
preserve  past  experiences,  correct  previous  mistakes  and  prevent  design 
oversights.  This  effort  attempts  to  maximize  structural  integrity  and 
reliability  but  the  concept  is  not  foolproof.  New  mistakes  are  always 
possible  with  the  rapidly  changing  state  of  the  art  and  the  increasing 
severity  of  the  operational  environment.  Because  of  these  complexities, 
the  documents  are  difficult  to  keep  current  and  new  or  revised  design 
requirements  are  normally  written  into  the  statement-of-work  for  any  new 
system  development,  if  they  occur  between  the  revision  intervals  of  a 
specification.  Criticism,  then,  that  certain  specifications  are  not 
current  or  that  certain  requirements  are  not  rational,  may  be  correct 
but  they  do  not  hinder  new  system  developments.  When  similar  criticisms 
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are  leveled  at  the  1.5  factor  of  safety,  however,  the  evaluation  is  not 
so  simple:  should  it  he  replaced  with  a reliability-based  concept? 

What  is  generally  not  appreciated  is  that  the  basic  airplane  design  loads 
(static  strength)  are  essentially  statistical  in  nature.  The  design 
values  are  derived  from  a broad  spectrum  of  operational  experiences. 

If  a distribution  were  assumed , then  the  design  limit  and  design  ultimate 
loads  would  represent  a certain  probability  of  occurrence  and  exceedance 
(Figure  14).  A justifiable  criticism  of  the  factor  of  safety,  tnough,  is 
that  a fixed  factor  does  not  recognize  the  variation  of  load  or  strength 
and  does  not  provide  a uniformly  efficient  structure  (Reference  25). 

This  effect  was  illustrated  in  References  18  and  20,  as  discussed  in 
Section  IV. 

Unofficial  Air  Force  recognition  of  a variable  factor  of  safety 
concept  has  been  established  by  allowing  certain  structural  design 
deviations.  The  static  test  failure  of  an  engine  inlet  duct  at  1.3  times 
the  limit  pressure,  for  example,  was  accepted  when  it  was  established 
that  the  internal  dynamic  pressure  in  the  duct  would  not  exceed  the 
design  pressure  in  a dive.  The  resul tant  delay,  redesign,  and  cost  to 
bring  the  duct  structure  up  to  the  normal  strength  level  of  1.5  times 
limit  pressure  was  therefore  avoided  (Reference  25). 

The  Air  Force  has  not  formally  adopted  a reliability-based  structural 
design  criteria,  although  some  requirements  have  an  associated 
probability  of  occurrence.  Available  procedures  that  could  be  adopted 
vary  in  concept  and  detail  but  their  philosophical  crinciples  are  the 
same.  References  26  and  27  summarize  some  of  the  philosophical  aspects 
that  appear  in  the  open  literature  and  also  note  the  complexity  of  the 
reliability  based  design  problem,  as  paraphrased  in  the  following  two 
paragraphs. 

The  many  proposals  for  a more  >'it:ionnl  criteria  are  related  to  the 
appearance  of  new  structural  mat  rials  which  exhibit  improved  strength 
and  stiffness  or  weight  characteristics.  Other  considerations  are  the 
extreme  increases  in  the  structural  loading  environment  and  concern  with 
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economic  costs.  Designing  to  an  acceptable  risk  while  keeping  all  design 
factors  in  proper  economic  perspective  would  seem  to  be  effective  but 
che  concept  of  risk  must  be  quantified  before  an  acceptable  risk  level 
can  be  determined.  The  new  materials  also  tend  to  exhibit  variations 
which  could,  in  a deterministic  design,  require  such  large  factors  of 
safety  as  to  nullify  the  improvements.  The  increase  in  extremes  of  the 
structural  load  environment  are  primarily  new  to  the  civil  engineering 
field  while  economic  costs  are  perhaps  new  to  the  aeronautical  field. 
[Reference  28  notes  that  the  aeronautical  engineer  has  for  many  years 
considered  new  failure  criteria  (fatigue  and  creep),  new  materials  and 
construction  (brittle  materials  and  fiberous  weaves),  and  more  complex 
loading  conditions  (temperature- load  histories).  This  has  resulted  in 
greater  variability  in  the  applied  and  failing  loads  than  has  been 
encountered  in  the  past.]  Picking  the  worst  possible  load  conditions 
for  design  is  no  longer  considered  economically  feasible  under  a broad 
spectrum  of  load  conditions  and  the  statistics  of  extremes  must  be 
considered  for  rational  design.  Reliability  based  analysis  permits  a 
more  consistent  approach  to  structural  safety  by  including  the  statistical 
variability  of  load  and  strength  in  the  factor  of  safety  evaluation 
(Reference  26). 


Most  of  the  early  studies  in  probabilistic  design  considered  only 
the  fundamental  problem  in  which  all  of  the  strength  variables  and  the 
load  variables  were  lumped  into  two  random  variables.  These  studies 
concentrated  on  the  effects  of  different  safety  factors,  coefficients  of 
variation,  and  frequency  distributions)  Later  studies  included  multi- 
member  and  multi  load  structures,  different  levels  of  failure,  and  the 
application  of  decision  theory.  Several  problems  must  be  considered  in 
the  context  of  a reliability  based  design,  first  is  the  reliability 
analysis  of  structures  with  derived  or  assumtd  probability  distributions 
for  random  variables,  including  load  and  strength  distributions; 
developing  and  constructing  the  necessary  computational  models  which 
account  for  i rule tenui nancy,  the  types  of  failure  .nodes  (including, 
elastic,  brittle,  and  collapse  modes),  the  number  of  load  conditions 
and  failure  modes,  and  their  statistical  correlation.  Another  problem 
is  the  desiiin  of  a structure  in  the  context  of  a random  variable  of 
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safety  for  a given  probability  of  failure;  the  random  variable  could  be 
cost  or  weight.  An  additional  problem  is  that  of  parameter  sensitivity 
and  determining  their  effects  in  the  load  and  strength  descriptions. 

Most  reliability  analyses  assume  that  strength  and  load  distributions  are 
known.  The  high  cost  of  obtaining  load  and  strength  data  will  probably 
necessitate  the  acceptance  of  lower  confidence  levels  in  structural 
design  than  professional  statisticians  usually  recommend.  Subjective 
Statistical  analysis  is  needed  together  with  studies  to  determine  the 
effect  on  optimum  weight  and  cost  due  to  changes  in  choice  of  frequency 
distribution,  coefficients  of  variation,  and  other  parameters  (Reference  27) 

As  part  of  its  program  to  maintain  and  develop  structural  design 
criteria,  the  Air  Force  has  sponsored  various  investigations  intended  to 
'■ead  to  < reliability  based  criteria  for  both  airplanes  and  missiles. 

One  investigation  (Reference  21)  was  parti  illy  presented  in  Section  IV. 

This  investigation  will  be  further  discussed  with  two  others  (References 
29  and  30).  These  three  investigations  emphasized  static  strength 
reliability,  although  fatigue  or  durability  requirements  can  be  in- 
corporated within  these  concepts.  0 her  Air  Force  investigations  have 
more  thoroughly  emphasized  the  fatigue  apects  of  a reliability  based 
criteria.  Reference  31.  for  example  treats  fatigue  design  considerations 
while  Reference  38  emphasizes  fatigue  but  also  provides  limited  treatment 
of  static  design  considerations.  Reference  31  is  an  extension  of 
Reference  82  and  Reference  33  is  an  evaluation  of  the  concepts  in 
Reference  31.  These  fatigue  feinted  references  are  noted  here  only  for 
completeness  and  will  not  be  emphasized  further.  The  three  investigations 
relating  primarily  to  ’static  strength  design  cons iderat ions , however, 
will  be  ;unnuri zed  in  more  detail  because  of  their  direct  correlation 
with  the?  factor  of  safety  corrupt.  In  expanding  these  three  reliability 
based  efforts,  the  philosophy  of  the  techniques  will  be  emphasized  and 
not  the  technical  aspects  of  their  development  or  application. 

A statistically  based  concept  developed  for  missile  design  is  found 
in  Reference  21,  Part  II.  The  concept  is  broad,  however,  and  can  be 
applied  to  almost  any  reliability  based  design  problem.  S' he  design 
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concept  is  basically  a framework  developed  to  be  consistent  with  the 
premise  that  there  is  no  definite  demarcation  between  safe  and  unsafe 
design,  but  a gradual  change  in  reliability  between  safe  and  unsafe. 

The  idea  that  a sharp  change  exists  between  safe  and  unsafe  can  cause 
unnecessary  redesign  for  every  slight  change  in  design  load  or  reduction 
in  allowables.  Redesign  should  be  required  only  when  the  overall 
reliability  of  the  system  decreases  appreciably.  The  term  "framework" 
applies  because  the  wide  scope  and  complexity  of  the  problem  did  not 
allow  final  refinements  to  be  made.  This  concept,  as  discussed  in 
Reference  21,  is  described  in  the  following  paragraphs. 


This  concept  uses  any  number  of  design  variables  that  are  essentially 
independent  of  each  other  to  determine  interaction  envelopes  that  separate 
failure  from  nonfailure  regions.  Design  parameters  are  presented  so  that 
criticality  continuously  increases  as  parameter  values  increase  or 
decrease.  By  superposition,  a single  interaction  envelope  is  formed 
and  the  probability  of  not  generating  points  in  the  failure  region  is 
the  quantitative  reliability  of  the  system  for  the  time  period  considered. 
To  simplify  the  computation  of  reliability  (which  could  be  obtained  by 
integrating  the  content),  an  equivalent  value  of  each  parameter  is 
defined  such  that  the  envelope  content  is  approximated  by  simple 
multiplication  of  the  probabilities  associated  with  the  probability 
value  of  each  parameter.  Any  number  of  statistical  parameters  can  be 
used.  Limits  are  imposed  only  by  the  analysis  time  and  data  available. 

As  data  is  defined,  the  number  of  parameters  can  be  optimized  and  should 
include  five  to  eight  that  are  random  varying  and  fifteen  to  thirty  that 
are  systematical ly  varying;  any  distribution  can  be  accomodated  without 
the  necessity  of  having  to  find  a special  function  of  the  variable. 


The  intersections  of  any  two  interaction  curves  are  defined  as 
"nodal  points,"  which  are  used  as  design  paints.  The  analysis  is 
relatively  insensitive  to  the  exact  interaction  envelope  shape  because 
any  reasonable  env. lope  shape  having  the  same  content  will  pass  near  the 
same  design  points  (figure  lb).  The  design  conditions  or  nod.:l  points 
are  defined  by  two  parameters,  one  having  a limiting  value  ( ^ ) and 


iuaCHu 


Alius  IK 

t lit-  other  a retoremo  value  i\,.  tin'  prohahilitv  value  \\,,  ..  ' at 
e.ti  It  point  is  Otpi.i  I to  tli;’  limitin')  value  minus  a rorm  I ion  fatter 
( ) wltuh  is  approsimated  In  ahalv:imi  representat  ive  probability 
distrihut  in. i shapes  ot  s inni t n ant  pa  r.imo  t «’f*-  0 I dure  1(0.  1 hr  pktorlal 

representation  r>  1 i in i t mt  hit  a mathomat  i<  al  extension  is  enniplotoH 
valid  amt  teasihle  tor  anv  number  of  parameters. 

. Power  spoitral  toihnii|uos  aro  used  to  evaluate  timo  dependent  of  toots 
atiit  other  simplitioil  loi  Inn, pit".  were  developed  tor  hanilliiiii  svstomatn 
variations.  \ method  <or  itotorminiiui  tlio  reiiuired  vontntoino  lovols  ot 
pa  rami' tors  is  also  ,nvon  to  assure  lonsistont  rolial'ilitv  analysis  a ml 
at i oniinoitat  ions  are  made  tor  tati.iuo  ami  troop  oltoits.  theater  approx i 
mat  ions  aro  .ill, 'wen  tor  soiomtan  dost  on  oltoits  than  tor  primary  otiovts 

1 ho  Isisii  tornopt  then  is  a somi  ompn  ii.i!  method  tot  quant  t tat  h oh 
dotori'iiniii'!  tin’  rohuhilitv  ot  a dot  mod  stria  (lire  or  tor  the  desi,|ii  ot 
a strut  t tire  to  a prestfihed  rel tabt  I , t- . I In*  d«nolopmout  is  based  on 
and  .lust  1 1 ios  two  hast,  promises  tliat  tu  the  .nidi*  lows  selection 

ot  dost  on  i nodal'  points  the  trm  mter.i,  t ion  envelope  shape  is 
unimportant  and  tliat  the  roliahilitv  i't  a s\stom  ian  ho  tabulated 

with  snitiiiont  a>  i iir.ii  \ In  simple  mu  1 1 ipl  n at  ion  ot  tlio  proh.tht  I i t ios 
ot  o.|iiiiaiont  parameter  prohahi  1 1 1 \ values  i.timr  than  In  : r. { »'*|ta f ion 
ot  the  intoiaition  envelope  lOntout  Althouoh  seoaumih  i oinplos  when 
rev  tewed,  (In’  oii*t lii'.l  ot  Kotoron.e  ,'l , Part  11.  i.  ti  In  us  mo  a illinium  of 
p.ir.inietors  and  iort,iin  rol  moments  and  with  some  additional  development 
and  appropriate  data,  Opproa,  h tlio  tailor  ot  satotv  method  in  simpltiitv 

dit  t oi  on  I tel  iahi  I it  v hast’d  lomopt  is  toun.l  m KoloroiiiO  .*** . 
Iioton’iiio  .‘I  dovoli’rod  a ■ tat  ist  i,  al  1\  t’.isod  >|uan!  i (at  i vo  ••tuiitural 
•to.  i. in  , i id  i’ a that  i elates  the  prohahi  I ist  t,  natuio  ot  dosian. 

...  opera  t tonal  and  onv  i roiiaviit  a I ospotion.os  to  strut  tural  .pertomim  o. 
Kotoromo  .’•>  devdoi's  a dotoiT’inist  i,  t rui  t it  t .1 1 dost  an  , iiteri.i  that 
uses  a iiiiant  ilat  tvt; 'ot’ioi  t tvo  and  i.ti  tous  statisjii.il  to,  hnt.pios  as 
dosiithod  in  ! tie  tollr.iin.i  oat  .t.;i  ao'f. 


n ' 


This  design  method  is  cha'rai  tori aod  b.v  the  thought  th.it  the  ability 
to  calculate 'a  prohahi  1 i ty  of  failure  when  load  and  strength  spectra  are 
assumed  to  be  Known,  vs  unite  differeni  than  the  ability  to  determine 
the  true  structural  reliability  of  an  operational  structural  system. 

The  method  also  incorporates  certain  considerations  that  appear  t.J  be 
overlooked  in  otho1-  approaches.  These  oversights  are:  (1)  errors  ni- 
di screw  no  i os  which  occur  between  actual  ami  calculated  spectra;  (T)  the 
influential  effect  of  testing  as  a means  of  design  error  disclosure; 

(3)  the  necessity  for  demons frating  proof  of  compliance  with  regu iryineius; 
and  (4)  the  necessity  for  assigning  responsibility  for  actions  which 
affect  structural  reliability.  Other  interactions  with  nons  trust  tiro ) , 
operational,  managerial,  and  contraotufa!  areas  ere  also  included. 

The  overall  investigation  and  proposed  desiun  concept  evolved  in 
three  steps.  The  first  step  evaluated  the  various  functions  which 
contribute  to  structural  design.  The  second  step  evaluated  and  compared 
the  current,  factor  of  safety  concept  and  a (hypothetical)  purely 
statistical  structural  reliability  concept  to  the  structural  performance 
and  design  functions  established  in  the  first  step.  The  third  step 
evaluated  existing  and  proposed  reliability  based  concepts  to  the  same 
standards  of  evaluation  used  in  step  two.  These  evaluations  concluded 
that:  (1)  the  current  factor  of  safety  design  technique  is  a sat i factory 
system  but  that  more  stringent  future  requirements  will  mininiae  the 
effectiveness  of  the  system;  (;’)  a purely  statistical  structural 
reliability  based  system  is  not  practical  since  there  is  no  way  to 
accurately  measure  structural  reliability  and  it  is  not  possible  to 
write  definitive  requirements  to  demonstrate  the  reliability  (proof  of 
compliance);  and  (3)  that  none  of  the  known  structural  reliability  based 
concepts  in  the  literature  today  provides  a satisfactory  foundation  vor 
a quantitative  structural  design  criteria  based  on  statistical  methods. 
To  elaborate  slightly  and  provide  an  appreciation  for  the  design  concept 
which  evolved,  the  philosophies  which  governed  ihr  develop. 'lent  will  be 
expanded  in  the  following  paragraphs. 
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The  fundamental  purpose  of  any  structural  design  effort  is  to  develop 
ar.  operational  structural  system  that  satisfactorily  performs  its  mission. 
This  development  is  the  result  of  many  management  and  engineering  decisions 
which  are  a key  element  in  the  success  or  failure  of  the  design  effort. 

One  aspect  of  the  factor  of  safety  concept,  is  that  the  design  effort  can 
be  practical  and  easily  administered  because  it  has  an  inherent  proof  of 
compliance  (test)  provision.  Its  fundamental  problem  is  that  it  has  no 
clearly  identifiable  quantitative  design  objective  to  satisfy.  The 
available  logic  cannot  resolve  the  comparative  adequacy  of  different  factor 
of  safety  values.  In  some  design  areas,  such  as  fatigue  or  high  temper- 
atures, the  factor  of  safety  is  not  even  directly  applicable  to  the 
definition  of  the  design  requirements.  The  concept  only  defines  a 
relationship  between  limit  and  ultimate  load,  which  normally  controls 
the  design  strength  level  and  does  not  allow  for  an  assessment  of  its 
"correctness,”  other  than  failure.  Positive  margins  of  safety  do  not 
prevent  failure.  Gross  errors  in  design  loads,  analysis,  and  large 
strength  scatters  contribute  to  failure  at  limit  load  or  less.  Structural 
tests,  on  the  other  hand,  are  a nearly  perfect  disclosure  of  gross  errors 
if  tne  strength  scatter  is  small,  as  is  customary.  The  trend  toward 
greater  scatter  and  a lessening  or  inability  to  disclose  analytical 
errors  requires  that  the  possibility  of  failures  below  limit  be  con- 
sidered more  seriously  in  the  future.  Further,  lest  conditions  are 
normally  selected  on  the  basis  of  the  strength  analysis  and  the  actual 
design  conditions  are  becoming  more  difficult  to  simulate  when  testing. 
Successful  ground  tests,  therefore,  do  not.  guarantee  successful 
operational  performance  and  flight  testing  will  remain  an  important 
design  development  consideration  regardless  of  the  design  concept  used.  . 

Current,  requirements  have  evolved  primarily  as  a reaction  to  past 
problems  and  the  assumoMcn  that  future  structural  systems  will  have  the 
same  characteristics  • past  systems  is  not  necessarily  valid.  When 
structural  failures  do  ociur,  tne  deterministic  nature  of  the  factor  of 
safety  concept  allows  the  determination  of  the  cause,  the  responsibility, 
and  the  corrective  action  to  be  taken.  Unfortunately , because  of  the 
many  interactions  between  the  strmture  ami  other  design  ceeas  which 
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contribute  to  structural  integrity,  responsibility  is  not  always 
recognized  until  after  a failure  has  occurred,  as  the  result  of  a design 
oversight.  These  and  other  considerations  previously  noted  relate 
primarily  to  the  factor  of  safety  concept  but  they  also  interact  with 
reliability  based  concepts.  Especially  important  are  the  considerations 
that  establish  design  compliance  and  responsibility  when  failure  occurs. 
When  cause  and  responsibility  are  not  determinable,  neither  is  the 
corrective  action. 

The  structural  design  concept  that  evolved  in  Reference  29  utilized 
the  desirable  features  of  the  factor  of  safety  concept  and  improved  or 
replaced  those  not  desirable.  The  following  basic  characteristics  are 
included  in  the  concept: 

1.  The  deterministic  type  of  requirements  that  give  the  factor  of 
safety  concept  its  practicality  and  administrability  are  retained. 

2.  A clearly  identifiable  objective  that  serves  as  a basis  for 
judging  any  proposed  modification  to  the  factor  of  safety  concept  is 
established. 

3.  A structural  reliability  goal  is  part  of  the  objective.  The 
goal  is  not  a requirement  since  structural  reliability,  per  se,  cannot 
be  determined  accurately  enough  to  serve  as  a contractual  requirement. 

4.  The  techniques  to  convert  the  structural  reliability  goal  into 
deterministic  requirements  based  on  statistical  considerations  are 
developed. 

5.  The  capability  to  deal  with  structural  systems  having  large 
strength  scatters  is  incorporated. 

6.  Specific  problems  such  as  fatigue  and  high  temperature  design 
can  be  integrated  into  the  structural  design  to  attain  the  defined 
objective. 
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7.  The  crucial  interfaces  with  nonstructural  design  requirements 
are  identified.  Provisions  are  made  for  assigning  responsibility  for 
every  function  that  affects  structural  integrity. 

8.  The  concept  of  testing  as  a disclosure  of  error  in  formulating 
design  requirements  is  utilized. 

Basically,  the  structure  should  have  a capability  to  survive 
designated  overload  and  understrength  situations  caused  by  undetected 
errors  or  oversights.  The  factor  of  safety  concept  provides  this 
capability  but.  the  provision  is  indirectly  and  inconsistently  applied. 
Structures  with  large  strength  scatters  are  basically  more  prone  to  fail 
from  understrength  considerations  rather  than  from  overloading.  The 
concept  in  Reference  establishes  separate  and  distinct  requirements 
for  understrength  and  overload  situations.  The  requirements  are  based  on 
probabilities  and  statistics  and  are  selected  to  be  consistent  with  a 
level  of  structural  reliability  appropriate  to  the  airplanes  mission. 

The  design  and  mission  relationships  are  illustrated  in  figure  17.  The 
central  bar  indicates  that  the  limit  design  load  includes  a provision  to 
handle  an  understrength  structure  to  avoid  failure  at  limit  load.  The 
right  or  left  bar  indicates  the  overload  provision.  The  left  bar 
illustrates  a large  overload  provision  and  overrides  the  uimers trength 
provision.  This  could  represent  a relatively  low  reliability,  high  load 
factor  fighter  airplane.  The  right'  bar  illustrates  a design  situation 
with  a smaller  overload  requirement.  Tim  understrength  provision  is  now 
more  critical  and  governs  the  design.  This  could  represent  a design 
requirement  for  a highly  reliable,  low  load  factor  transport  airplane. 
Once  the  appropriate  design  values  are  chosen,  they  become  deterministic 
and  are  as  easy  to  administer  as  the  conventional  factor  of  safety 
concept. 

The  first  implementing  step  is  to  select  a structural  reliability 
goal  consistent  with  the  mission.  The  goal  is  not  a requirement  and 
suggested  values  are  given  in  References  ;’ll  and  .10.  The  limit  and 
ultimate  design  conditions  are  two  separate  conditions  based  on  the 
reliability  goal  and  established  by  statistical  or  qualitative 
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considerations,  which  reflect  available  experience.  The  design  limit 
condition  is  the  upper  bound  of  a normal  or  expected  (permissible) 
operating condition  while  the  ultimate  condition  is  an  abnormal  opera- 
tional condition  reached  only  as  the  result  of  an  operational  error  or 
failure  of  a nonstructural  system.  Failures  within  the  understrength 
design  provision  are  a structural  responsibility  and  require  correction, 
while  failures  from  overloads  require  operational  corrections.  There  is 
nc  fixed  factor  of  safety  separating  the  limit  and  ultimate  condition; 
the  ultimate  condition  in  Reference  ;’9  does  not  represent  the  conventional 
meaning  of  ultimate  load.  The  condition  is  separate  and  unrelated  to  the 
limit  condition,  whose  meaning  does  not  change.  The  ultimate  condition 
is  a design  condition  based  on  a rare  or  abnormal  situation  and  may  be 
significantly  different  from  the  conventional  ultimate  load. 

The  basic  structural  design  is  qualified  and  approved  by  conventional 
ground  and  flight  tests.  Ground  test  loads  are  defined  by  a limit  or  an 
ultimate  test  factor  of  safety.  The  factor  select,  d . aries  according  to 
the  established  structural  reliahi  t,v  goal  and  by  the  number  of  tests 
conducted.  Example  values  are  shown  in  figures  18  and  19.  Flight  tests 
are  conducted  in  a conventional  manner  and  operational 1 flight  load 
monitoring  are  required  to  verify  operational  consistency  with  design. 

If  not  consistent,  the  structure  would  require  modification  when 
operations  are  determimental  or  the  operational  procedures  may  r-quiro 
some  change. 

There  are  many  rumificat  ms,  qualifications,  advantages,  and  dis- 
advantages re  Kited  to  reliability  based  deshin  concepts  as  expressed  in 
Reference  .’9.  Most  of  the  associated  disadvantages  or  problems  are  not 
new  but  have  always  been  problems,  such  as  the  statistical  definition  of 
design  data.  No  new  problems  are  created  by  introducing  reliability 
based  concepts  but  old  problems  become  more  ei early  defined.  The  basic 
advantage  of  the  proposed  concept  in  Reference  ft  j>  its  ability  to 
establish  structural  performance  in  terms  of  a guanti:  >tiveh  definable 
goal.  Ibis  permits  toe  dot  ini'tioi:  of  the  minimum  strin  ;.ra  I requirements 
to  meet  t tit-  goal.  It  also  permits  t nr  .just : f icat  ion  of  a less  severe 
structural  design  iriieri1  when  warranted,  bn  a use  each  ot  'tie  design 
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aspects  is  quantitized,  trade-offs  can  be  made  between  criteria  reductions 
and  the  difficulty  (technical,  cost,  time)  of  providing  more  efficient 
structural  characteristics. 

The  proposed  reliability  based  concept  in  Reference  29  is  reviewed 
in  Reference  30  to  identify  data  requirements,  necessary  changes  to 
design  specifications  and  handbooks,  interactions  with  nonstructural 
design  areas  and  the  steps  required  to  implement  the  concept.  To 
illustrate  each  step  of  the  concept.  Reference  30  uses  several  design 
examples.  First,  simplified  dummy  data  is  employed  and  then  realistic 
data.  The  categories  of  required  data  are  defined  further  by  a study  of 
data  pertinent  to  the  C-141  cargo  airplane  and  then  by  a trial  applica- 
tion of  the  concept  to  its  wing.  The  revision  of  data  to  reflect,  an 
improved  state  of  knowledge  at  each  design  stage  and  during  the  life  of 
the  vehicle,  and  the  form  in  which  the  required  data  might  be  standardized, 
is  also  discussed.  Although  the  limited  study  did  not  allow  an  extensive 
treatment,  of  data  requirements.  Reference  30  provides  insight  to  the 
complexities  of  the  data  problem  as  it  relates  to  reliability  based 
design  and  similar  concepts.  The  data  requirements,  limitations,  and 
design  interactions  are  presented  in  the  following  paragraphs. 

To  bo  effective,  data  must  bo  established  and  updated  continuously. 
Fundamental  dat  are  operational  load  spectra,  error  functions,  and 
strength. distributions.  These  data  will  change  periodically  during  the 
total  lifetime  of  a specific  airplane.  The  particular  periods  that 
permit  progressive  updating  are  the  initial,  detail,  and  final  design 
phase,  betore  and  after  tests,  and  be' ore  and  during  airplane  operations. 
It  is  through  the  airplanes  operation  that  quantities  of  new  data  can 
be  obtained;  the  data  are  also  pertinent  to  ether  design  concepts. 

In  dune  1%4,  a special  panel  report  (Reference  34)  of  tlu-  NACA 
kub:  ommi t fee  on  Aircraft  loads  recommended  a program  to  obtain  sta- 
tist nal  information  on  maneuvers  arid  related  inflight  loads,  whether 
caused  by  pi  tot  inducement  or  atmospheric  turbulence.  The  panel  also 
, recommended  that 'the  Air  Force  and  Navy  obtain  time  histories  of  three 
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linear  and  three  angular  accelerations  about  mutually  perpendicular 
axes,  airspeed,  and  altitude  to  establish  a statistical  design  base.  The 
recommended  statistical  maneuver  load  program  was  initiated  as  a joint 
effort  by  the  Air  Force,  Navy  and  the  NASA  in  1956. 

In  1958  the  Air  Force  outlined  a long  term  program  to  collect  and 
utilize  flight  measured  data.  The  program,  initiated  iri  1959,  was  to 
develop  techniques  for  integrating  the  statistical  data  into  existing 
design  criteria,  review  and  improve  .the  data  recording  and  reduction, 
and  to  establish  fundamental  requirements  for  structural  criteria  based 
on  statistical  methods.  The  resulting  effort  identified  certain 
problems  which  were  grouped  into  three  categories:  the  definition  of 
design  conditions,  the  definition  of  component  strength  distributions, 
and  mathematical  procedures  relating  the  first  two  to  structural 
reliability.  The  program  also  led  to  the  sizing  and  establishment  of  a 
data  reduction  facility  by  the  Navy  and  an  8-channel  recorder  development 
program  by  the  Air  Force.  State  of  the  art  limitations  eventually 
terminated  the  recorder  development  program  and  in  turn  closed  the  data 
reduction  facility  in  1969.  References  35  and  36  are  documents  relating 
to  this  effort.  Other  investigations  which  have  defined  data  requirements 
and  collection  programs  for  missiles  are  described  in  References  16,  24, 
37,  38,  39,  10  and  41. 

More  recently,  the  operational  data  recording  program  for  airplanes 
has  continued  as  the  Air  force's  Aircraft  Structural  Integrity  Program 
(ASIP),  as  defined  in  Military  Standard  1530A,  by  the  same  title,  dated 
II  December  19/5.  As  part  of  the  ASIP,  each  airplane  system  will  be 
monitored  to  obtain  time  history  records.  The  parameters  necessary  to 
monitor  operational  usage  and  derive  stress  spectra  critical 
structural  areas  will  be  measured  in  approximately  20  percent  of  the 
operational  force. 

To  accomplish  the  ASIT,  the  Air  Force  initiated  plans  in  1968  to 
develop  a new  and  more  universal  multichannel  recording  system  to  less 
stringent  standards  than  the  previous  8-channe  recorder.  New  requirement 
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were  prepared  and  in  June  1970  the  development  of  a 24-channel  digital 
recording  system  and  a ground  playback  unit  were  started.  The  system 
has  been  developed  and  is  now  in  limited  use.  The  data  tapes  for  each 
system  will  be  collected  and  compiled  at  a single  location  when  the 
program  is  fully  implemented.  The  parameters  measured  and  sample  rates 
can  be  varied  to  the  specific  needs  of  each  system.  Figure  20  is 
typical  of  the  data  to  be  collected.  Plans  to  establish  the  necessary 
parameter  correlations  and  design  load  spectra  from  the  ASIP  data  are 
being  formulated. 

The  major  objective  and  justification  for  the  multichannel  program 
is  to  provide  a better  tool  to  accomplish  fatigue  tracking.  However, 
because  of  tne  high  commonalty  between  data  needed  for  fatigue  and 
statistically  based  strength  design,  the  reliability  based  design 
concepts  will  also  benefit.  When  a recorder  program  on  a certain  system 
matures  to  the  point  that  statistical  stability  is  obtained  and  no  new 
operational  fatigue  related  information  is  produced,  or  when  certain 
parameters  attain  statistical  stability  and  need  not  be  recorded  full 
time,  the  resulting  surplus  of  recorder  capacity  can  be  used  to  establish 
statistical  strength  criteria  or  to  fill  knowledge  gaps;  for  example, 
the  phasing  of  power  spectral  density  (PSP)  loads.  In  gust,  analysis, 
current  PSD  methods  allow  a fairly  precise,  but  separate,  determination 
of  shear,  bending,  and  torsion  at  a given  location;  the  phasing  of  the 
three  vectors  is  largely  a guess.  The  addition  of  strain  gage  clusters 
or  rosettes  at  selected  locations  could  nrovide  actual  examples  of  the 
amplitude  and  frequency  relationships.  Such  data  will  be  essential  in 
future  designs  to  express  applied  loads  ami  structural  strength  in  a 
common  set  of  terms. 

Ideally,  derived  data  can  he  standardized  ami  categorized.  A 
convenient  approach  would  be  provided  bv  charts  relat  i mi  the  ••eguired 
design  and  test  factors  to  the  reliability  levels  in  terns  of  parameters 
describing  the  load  strength  distributions,  the  error  function,  ami  the 
number  and  type  of  tests.  1 heoret ii  a! I y,  it  would  appear  possible  to 
develop  a single  load  spoitrum  tor  each  location,  which  would  contain 
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the  total  load  occurrences  for  an  airplane  lifetime,  However,  t(u 
simultaneous  consideration  of  both  limit  (normal)  and  ultimate 
(abnormal)  loading  condi tioc.s  will  seldom  be  possible  because  the 
permissible 'Strength  level  will  generally  be  different,  i.ach  structural 
location  will  require  separate  analysis,  since  both  load  and  strength 
distribution  will  differ  from  noint  to  point. 

The  statistics  available,  even  on  airplanes  which  have  extensive 
operational  experience,  are  not  adequate,  for  example,  additional 
information  is  required  on  the  probabilities  of:  (1)  weight  and  weight 
distribution;  (;’)  speed  amt  altitude;  (.<)  types  of  load  conditions 
(gust,  pull-up,  rudder  kick,  etc.);  (4)  level  of  loading  (in  terms  of  a 
basic  parameter);  (h)  time  history  of  loading  (to  describe  local  loading); 
(6)  associated  load  systems  (pressure,  thermal  gradient,  etc.).  These 
probabilities  are  no?  independent  and  the  resultant  probability  of  each 
combination  is  also  needed.  In  addition  to  the  average  or  typical 
conditions  at  fining  each  segment  of  the  mission  profile,  it  is  aecessc'v 
to  derive  or  assume  the  shape  ami  distribution  about  the  mean.  Without 
this  detailed  level  of  data,  no  realistic  estimate  of  the  risk  of 
failure  can  be  made. 

Although  extensive  material  strength  data  exist,  the  allowables 
represent  only  one  discrete  point  in  the  distribution.  Jhe  form  of  data 
required  consists  ot  the  mean  and  standard  deviation  and  t tie  shape  of 
thi'  distribution  to  be  used.  The  stem  tura'I  strength  ot  the  final 
component  will  also  retleit  the  vac  ations  imposed  l>v  ail  ot  the 
inherent  operations  in  tabriiation  and  .ts.emblv.  data  on  the  strength  ot 
various  stein  final  , out  unua!  ions  exists  onl\  in  a random  manner  and 
usual  Iv  in  instilt  1,‘i’ent  gnahtitv  t o prov  i.le  adegu.it  e st  at  I st  i- al 
. d is  t r i!'u i ions 

It  is  f reqiient  I v (iis  essai  v to  assume  Hit'  all  ohserva  t ions  a»'e  of  a 
single  homogeneous  juguil.il  ion  whose  ,1'st  iibut  ion  lollov.  a stand  >rd  form. 
Sui  h assumpt  ions  ot|,ni  give  good  tits  neat  the  most  frequently  on  tiering 
values  but  tin  the  struitur.il  reliability  problem  other  t.n  tors  require 
emphasis,  the  major  diftereiue  between  striutur'i  and  lommon  reliability 
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analysis  is  that  tht'  moan  time  to  failure  is  not  a desirable  measure  of 
reliability.  !t  is  the  risk  of  failure  that  is  required  for  a structure 
There  is  no  acceptable  failure  rate  and  much  more  emphasis  is  therefore 
placed  on  high  (abnormal)  loads  ami  unusually  low  strengths.  This 
emphasis,  then,  requires  that  the  statistical  representations  match  the 
appropriate  tails  of  the  distributions  rather  than  the  region  near  the 
more  frequently  occurring  values. 

The  formal  recognition  of  possible  errors  is  probably  more  important 
than  the  specific  definition  of  an  error  function.  The  error  function 
may  describe  any  number  of  discrepancies,  however  caused,  in  terms  of 
the  distribution  of  the  probable  mean  strength  of  the  structure.  A 
number  of  suitable  functions  aie  available  for  initial  design  use.  The 
degree  of  dispersion  (coefficient  of  variation)  has  relatively  little 
influence  once  the  test  results  have  been  incorporated,  when  tests  are 
used  as  an  error  disclosure.  A relatively  low  * s k would  probably  be 
introduced  by  the  adoption  of  a standard  error  function. 

The  implementation  of  an  i 'liability  based  technique  will  present 
certain  problems  and  Reference  30  suggests  a two  stage  process. 

Initially,  there  will  be  insufficient  dab*  available  to  implement  a 
total  reliability  based  design  concept  and  emphasis  should  be  placed 
on  the  comparative  similarities  with  the  existing  factor  of  safety 
design  c oncept  rather  than  the  di t fereiu  es . However,  even  restricting 
the  reliability  concept  to  design  conditions  for  which  data  is  available 
will  help  establish  a correct  understanding  of  the  probabilistic 
processes  and  encourage  the’  acquisition  of  the  data  required  for  further 
implementation 

I he  first  phase  would  apply  the  reliability  . oncept  to  selected 
design  conditions  and  primarily  emphasize  familiarity  with  terminology 
and  mathematical  relationships;  the  rela’ive  importance  of  parameters; 
evaluating  the  implied  reliabilities  ot  existing  airplanes;  and  insuring 
that  continuiiv  with  existing  design  concepts  exists  so  that  :io  abrupt 
changes  m structural  integiitv  will  exist,  lhe  interactions  between 
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static  strength,  fail-safe  strength,  fatigue  strength  and  damage 
tolerance  strength  also  require  identification  to  permit  the  whole 
spectrum  r tructural  reliability  to  be  expressed  in  a consistent 
manner. 

The  second  or  final  stage,  that  of  achieving  a meaningful,  completely 
probabilistic  concept,  will  not  be  possible  until  quantities  of  additional 
statistical  data  are  obtained,  especially  for  asymmetric  flight  cases  and 
combinations  of  parameters  which  are  not.  independent.  Not  only  must 
every  possible  cause  of  loading  be  established  in  probabilistic  terms  but 
every  factor  affecting  the  strength  must  be  established.  Unless  a total 
picture  is  assembled,  nothing  will  be  known  about  the  relative  importance 
of  the  various  design  conditions  and  interactions,  about  ways  of 
changing  the  reliability  results  by  modifying  the  operating  conditions, 
or  by  redesign  of  the  structure.  When  reliability  results  are  further 
specified  as  a single  numerical  value,  even  when  specified  as  a goal, 
the  relative  merit  of  different  values  regarding  safety  and  possible 
redesign  must  be  considered.  The  concept  of  a single  numerical  value 
for  the  reliability  of  an  airframe  or  even  a specific  location  on  the 
airframe  is  superficially  attractive,  but  any  real  advantage  is 
completely  offset  by  problems  of  interpretation  of  the  number.  Any 
judgement  as  to  acceptabi 1 i ty  of  one  reliability  number  over  another 
that  is  slightly  different  will  remain  arbitrary.  It  is  probable  that 
a relative  risk  assessment  tin-. unique  will  prove  to  be  worth  while  even 
when  all  of  the  necessary  statistical  data  are  available  and  a completely 
probabilistic  design  concept  can  bo  achieved.  Final  implemontat ion  will 
be  governed  by  experiences  gained  during  the  first  phase  and  the 
avai lability  of  design  data. 

The  next  set t ion"  will  attempt  to  place  these  thoughts  and  ideas,  and 
those  of  previous  sections,  into  perspective  by  further  relating  them 
to  current  design  practice'. 
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SECTION  VI 

CONCEPT  INTERACTIONS 

The  factor  of  safety  has  lost  some  of  its  appeal  in  recent  years  and 
probability  analysis  has  been  emphasized  as  a more  rational  concept.  For- 
merly, the  complexity  of  reliability  based  concepts  centered  around  the 
.analytical  aspects  of  the  solutions  but  this  difficulty  has  been  offset  by 
curre  computer  technology.  Today  the  prime  restraint  is  available  design 
data  in  the  proper  statistical  form  (Reference  ?1). 

Dissatisfaction  with  the  factor  of  safety  concept  became  more  apparent 
during  the  early  1 960 ' s when  surveys  of  airplane  and  missile  manufacturers 
were  conducted  in  conjunction  with  various  Air  Force  structural  design 
criteria  development  programs.  The  general  industry  feeling  that  the  fac- 
tor of  safety  is  growing  more  and  more  inadequate  has  apparently  not  changed. 
The  initial  dissatisfaction  applied  primarily  to  missiles,  but  airplanes 
were  not  excluded.  The  surveys  also  found  that  the  degree  of  availability 
of  flight  measured  data  varies  greatly  between  systems.  Its  quality  and 
quantity  are  both  deficient  and  the  parameters  most  needed  for  reliability 
based  design  concepts  are  often  not  measured.  Cost  and  the  inability  to 
access  a system  for  the  purposes  of  instrumentation  and  data  measurement 
often  become  insurmountable  problems. 


Whether  using  a factor  of  safety  or  a reliability  based  concept,  the 
airframe's  probability  of  failure  will  be  sensitive  to  the  number  of 
significant  design  parameters  (assuming  all  significant  parameters  are 
accounted  for)  and  their  statistical  distribution.  The  design  data  must 
encompass  all  ot  the  natural  environments,  induced  environments,  opera- 
tional variations,  material  properties,  and  built-up  structural  properties; 
the  total  number  ot  specific  parameters  requiring  statistical  definition 
becomes  significantly  large,  lhe  state  ot  the  art  and  practical  limitations 
in  establishing  accurate  statistical  data  for  each  significant  parameter  is 
such  that  the  actual  results  may  be  more  academic  than  related  to  actual 
needs.  Unless  tne  available  data  are  carefully  selec  ted  and  reduced, 
considerable  ettoit  could  be'  expended  with  lew  conniei.Sucate  results. 

'0 
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Although  the  validity  of  extrapolating  data  tor  t esiyn  use  is  taken 
for  granted  certain  precautions  must,  be  exercised.  Too  often  design  data 
have  been  compiled  from  inappropriate  or  limited  samples.  Data  must  re- 
flect operational  conditions  from  all  segments  of  the  Air  Force;  pilots 
must  be  qualified  or  typical,  not  highly  experienced  flight  test  pilots; 
weather  conditions  must  be  proportioned  between  good  and  bad  flying  condi- 
tions, and  daylight  and  night  operations;  and  weather  cycles  occurring 
during  the  year  and  over  a period  of  years  must  be  considered.  Some  para- 
meters have  physical  limits  or  practical  upper  limits  and  any  assumed  distri- 
bution must  consider  a reasonable  cut-off  value.  Extreme  values  become  less 
accurate  as  they  progress  away  from  the  mean  and  influence  design  confidence. 
Values  selected  closer  to  the  mean  could  affect  flight  safety.  As  a logical 
extension  of  the  realization  that  all  airplanes  of  a certain  type  cannot 
(statistically)  meet  the  design  economic  or  fatigue  life  expectancy,  there 
is  a trend  to  develop  exceedance  curves  for  design  that  represent  average 
rather  than  extreme  environments  formerly,  airplanes  were  always  designed 
to  the  maximum  expected  or  extreme  environments  for  both  static  and  fatigue 
strength  and  the  static  loads  induced  were  increased  by  the  factor  of  safety. 
The  effect  of  this  design  trend  on  flight  safety  cannot  be  assessed  but  the 
importance  of  selecting  proper  design  parameters  and  having  a factual  data 
base  increases. 

The  1 .natations  whicn  inhibit  induced  load  measurements  have  led  some 
to  believe  that  the  factor  of  safety  should  be  retained  on  loads  but  that 
all  other  desig»  considerations  (which  are  assumed  to  be  well-defined) 
should  he  evaluated  by  a rational  statistical  analysis.  These  concepts 
might  lead  to  a refinement  of  current  design  procedures  but  do  not  change 
the  procedures  since  statistical  cunsidei at  ions  have  long  been  a part  of 
airplane  and  missile  design  criteria.  Although  probability  factors  for 
structural  design  are  seldom  expressed  in  current  criteria,  the  choice 
of  limit  load  factors  for  static  and  fatigue  strength  and  various  environ- 
mental design  parameters  are  fundamentally  based  on  flight  and  environ- 
mental statistics  (Reference  ;\T). 


80 
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Perhaps  the  most  important  contrihut ion  to  airframe  safety  is  that 
of  testing.  As  so  aptly  noted  in  Reference  4i\  "safety  regulations,  how- 
ever good  and  sophisticated,  should  always  provide  for  approval  based  upon 
relevant  experiment,  such  as  tne  measurement  or  control  of  actual  loads,  the 
measuranent  of  the  actual  strength  of  components,  and  the  demonstration  of 
the  performance  of  the  complete  structure  by  proof  or  stiffness  tests."  This 
practice  has  .long  been  the  custom  of  the  aeronautical  engineer.  Both  ground 
and  flight  tests  are  used  to  demonstrate  design  integrity  arid  optimize  the 
conflicting  requirements  of  minimum  weight  and  maximum  structural  reliability. 
Optimization  and  economic  airframe  life  requirements  have  in  recent  years  placed 
considerable  emphasis  on  developmental  testing.  This  emphasis  will  probably 
increase  in  future  years.  Although  testing  is  a very  cost  effective  design  and 
substantiation  tool,  the  expense  of  testing  is  a major  obstacle  to  obtaining 
more  appropriate  statistical  data  for  reliability  based  design  concepts  and 
statistical  substantiation  of  structural  reliability.  Some  of  the  interacting 
roles  of  structural  analysis  and  testing  are  discussed  in  Reference  43. 

A natural  extension  to  current  practice  is  the  use  of  additional  factors 
and  design  parameters.  This  concept,  is  less  complex  and  easier  to  manage  in  a 
rapidly  changing  design  environment  than  using  a variable  factor  of  safety. 

The  modified  factor  of  safety  concept  (Reference  :'l ) factors  three  performance 
variables  and  it  could  be  expanded  to  include  others,  Going  further.  Reference 
38  suggested  that  the  factor  of  safety  on  loads  for  missiles  could  be  reduced  in 
certain  instances  when  a particular  load  source  is  highly  predictable,  thrust 
for  example.  However,  Referenee  In  expressed  the  view  that  although  some  de- 
sign load  sources  are  highly  predictable,  the  combined  design  load  may  be  ex- 
ceeded for  some  design  conditions  when  components  of  the  combined  load  are 
reduced.  In  effect,  known  conservat  isms  compensate  for  the  unknown. 


The  additional  design  complexity  imposed  by  a new  or  revised  concept 
on  structural  analysis  must  also  be  considered.  Associating  a specific  fac- 
tor with  a specific  variable,  regardless  o*  the  number  of  factored  variables, 
will  provide  a certain  level  of  additional  complexity  to  a lo.  distress  analysis; 
using  a variable  factor  ot  safety  and  specif u parameters  will  add  ^different 
level  of  complexity,  fomputeri zed  analysis  tethnigucs  can  relieve  some  ot  the 
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bookkeeping,  but  considerable  additional  judgement  in  design  is  required  as 
compared  to  using  a single  factor  of  safety  on  load.  Although  less  complex, 
the  single  factor  of  safety  on  loads  will  not  satisfy  the  objective  to  control 
structural  reliability,  the  single  factor  is  a function  of  numerous  variables 
which  can  vary  structural  reliability  appreciably  and  not  impose  a change  on 
the  factor  itself.  Also,  if  new  factors  of  safety  are  applied  to  additional 
design  parameters  or  if  revised  or  variable  factors  are  applied  to  loads,  the 
years-of  experience  and  backlog  of  compensating  design  limitations  and  related 
requirements  which  we  have  for  the  conventional  factor  of  safety  will  be  lack- 
ing and  design  confidence  will  decrease  until  a new  base  can  be  established. 

Major  changes  in  airframe  design  technology  are  usually  lccompanied  by  a 
comparison  with  existing  techniques  prioc  to  adoption.  Reference  30  illus- 
trates a limited  comparison  of  this  type  as  discussed  in  Section  V.  Other 
studios  have  made  comparisons  relating  equivalent  factors  of  safety  to  a com- 
patible reliability.  Such  comparisons  can  be  found  in  References  ?8,  44,  45, 
and  46.  There  is  a similarity  between  reliability  and  factor  of  safety  con- 
cepts which  becomes  more  obvious  when  the  factor  of  safety  is  viewed  as  a con- 
cept based  on  the  statistical  definitions  of  many  basic  design  parameters. 

Each  design  parameter,  however,  is  normally  reduced  to  a specific  value  and 
the  concept  becomes  deterministic  rather  than  probabilistic.  To  further  the 
analogy,  the  design  (ultimate)  and  operational  (limit.)  stresses  can  each  be 
assumed  linear  and  represented  by  a frequency  distribution.  The  ratio  of  the 
mean  stresses  if, each  assumed  distribution  can  then  he  defined  as  a factor  oi 
safety.  Refer,  nee  44  uses  this  analogy  to  show  that  the  level  of  reliability 
can  \ try  widely  for  the  same  factor  of  safety  value.  As  proportional  changes 
are  made  to  the  stress  ratio  or  to  the  shape  of  the  distributions,  the  over- 
lap i the  tails  of  the  distributions  varies  and,  in  turn,  the  reliability 
varies.  A fixed  lac  tor  oi  safety  cannot , therefore,  ensure  a constant  level 
of  reliability  without  considering  the  statistics  ot  the  design  strength  and 
operational  stresses.  Reference  4-  further  exp  i a mis  that  the  factor  ot  safety 
can  be  placed  on  a more  rational  tv.is  and.  m.  fact,  only  has  meaning  when 
related  to  the  concept  of  reliability. 
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The  degree  of  safety  desired  or  required  also  varies  according  to 
the  particular  point  in  the  V-6  diagram  which  is  involved.  The  left  hand 
corners  of  the  diagram  represent  maximum  lift,  coefficient  and  the  maximum 
load  possible  (not  considering  the  small  increase  maximum  lift,  coeffi- 
cients that  can  occur  under  dynamic  conditions  and  which  may  be  used  in 
constructing  the  diagram).  Thus,  if  a static  test  has  been  conducted 
satisfactorily  and  validated  by  flight  measured  loads,  it  would  be  physi- 
call.y  impossible  to  have  a static  structural  failure  at  these  points  when 
operating  normal iy.  A similar  statement  may  be  made  of  the  flight  controls, 
which  are  limited  in  loading  to  specific  boost  capacities,  and  in  a more 
gener  1 sense,  to  inlets  which  are  designed  to  specified  pressures  corres- 
ponding to  maximu  speeds  at  which  tne  airplane  will  fly.  The  airplane  may 
physically  exceed  the  design  speed  and  maneuver  limits,  but  it  has  turned 
out  in  practice  that  pilots  have  ke|  t the  aircraft  within  speed  and  maneuver 
limits  without  difficulty.  In  those  cases,  it  might  be  logical  to  consider 
a lower  factor  of  safety  than  that  considered  for  tie  right  hand  corners  of 
the  VG  diagram  (Reference  2b). 

exceptions  to  no'-mally  controlled  flight  conditions  are  instabilities 
which  cause  design  V-Md  factors  to  he  exceeded.  T ho  factor  of  safety  does 
not  rerogn  ;r  aerodynamic  instabilities  in  design.  Even  with  an  extensive 
operational  bacf  i round,  past  experiences  show  that  all  static  flight  failures 
cannot  he  pre<:!  ted.  Several  late  !l,!>0's  airplanes  have  been  lost  because  of 
unaccounted  Tor  aeiorlastic  effects.  Some  losses  were  the  result  of  aero- 
dynamic iiit  rui  ions  and  one  resulted  from  improperly  predicted  spanwise  wing 
load.  'Some  • : • uc t ura 1 failures  could  have  been  prevented  within  the  state 
•’  mi'  art  ! i trior.-,  have  resulted  from  new  phenomena  not  anticipated  or  a. 

a siihsegiier'  >et  to  a prior  turbuleiue  upset  'Reference  '.'b). 

• Mur-  iv  ei  ' examples  of  s'.r  nctl  failure  can  he  cited  for  both  fighter 
a ,i  iraiisj'  ■-.•lane-.,  If.e-.r  -.ainples  resulted 'ft  oiii  i ontro?  system  mal  nine - 
■ oi:  . . ilr-  ".  '!.  1 i.pit  siriu  ti  ' al  failures  sut'sea.ioiif  1 \ i'o  urred  to  the  wings 

■ fat1  .'tec.'  e-  ■,'(>!(-  cracwed  and  mayor  tail  k-skm  wing  planks  bin  ame 

.'ei  .it  her  fr "!  ■ r,*. t jhi  1 it  ie-.  were'  event u.lih  over,  on*  . ' .1! . fb.es e strut  tin  t's 

m he-  tf;  a 'o  a 1 owe>  *'a.  tor  of  »afeJ  v or  'to  a or-.  iqn  load 


concept  ha v inn  an  effective  factor  of  safety  lower  than  1.5,  these 
airplanes  would  probably  have  failed  catastrophically  in  flight.  This 
failure  projection  is  hypothetical,  hut  these  real  examples  of  structural 
overload  reflect  the  inherent  conservatism  in  today’s  airframe  and  the  need 
for  overload  protection.  It  is  unlikely  that  the  dollar  value  associated 
with  the  cost  of  the  airplane  and  crew  training,  for  any  one  of  the  several 
airplanes  affected,  could  be  offset  by  the  savings  in  weight,  the  performance 
gained,  or  operational  costs  saved  by  using  a design  concept  that  might  pro- 
vide u lower  le  el  of  structural  safety. 

There  is  another  measure  of  safety  to  be  accounted  for  beyond  the  normal 
overload/undtvstrength  probability  limits  of  structural  failure.  Extraneous 
causes  of  structural  failure  may  arise  which  are  not  part  of  an  original  de- 
sign evaluation.  Instances  of  pi  or  maintenance,  improper  assembly  or  reassem- 
bly, substitution  of  improperly  heat  treated  components,  etc.,  are  well  known. 
Other  phenomena  sum  as  hydrogen  embrittlement  and  stress  corrosion  may  not 
be  adaptable  to  statistical  design  procedures  and  the  statistical  limitations 
of  small  coupon  or  structural  component  tests  are  also  well  known.  Even  if 
these  events  can  be  statistically  accounted  for,  their  significance  could 
overshadow  the  probability  of  normal  structural  failure  when  considering 
reliability  based  criteria  (Reference  25). 

There  is  still  another  safety  aspect  to  consider.  The  factor  of  safety 
does  interact  with  other  design  and  analysis  requirements,  although  it  is 
often  viewed  as  an  independent  measure  of  structural  safety.  Reference  4? 
is  a s uuy  of  comparisons  between  existing  and  proposed  civil  engineering 
requirements  that  emphasize  a similar  interaction.  The  study  first  notes  the 
many  uncertainties  in  design  and  construction  that  are  covered  by  providing 
overload  protection.  The  facets  noted  are  identical  in  context  to  those 
considered  within  the  factor  of  safety  concept  for  airframe  design.  Similar- 
ly, the  (actor  of  safety  concept  is  noted  to  be  a crude  method  of  covering 
analytical  and  construction  errors,  but  the  reference  also  notes  that  it  ha> 
the  merit  of  simplicity.  The  study  evaluated  a variety  of  structures  exposed 
to  three  loading  conditions.  It  compared  the  quant i 1 1 < of  flexural  steel 
required  for  each  design  case  and  assessed  the  theereti  al  overload  nuctit” 
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of  the  structures.  The  steel  requirements  using  both  the  old  and  new 
requirements  were  found  to  be  very  similar  for  each  loading  condition  but 
the  presumed  overload  protection  was  found  to  vary.  It.  was  initially  pre- 
sumed and  implied  in  the  specifications  that  the  theoretical  overload  pro- 
tection would  be  proportional  to  the  factor  of  safety  associated  with  each 
load  system.  However,  the  strength  was  not  proportional  to  the  factors  of 
safety  used.  This  occurred  because  the  design  of  the  adjacent  spans  in  the 
structure  used  different  factors  depending  on  how  they  were  loaded;  in 
some  cases,  the  loaded  spans  were  counterbalanced  by  an  exaggerated  (factor- 
ed) dead  load  on  the  adjacent  unloaded  spans.  The  overload  capacity  of  the 
loaded  spans  was  not  directly  proportional  to  the  factor  of  safety. 

Even  though  the  study  showed  a variation  in  overload  capacity,  existing 
structures  designed  to  these  requirements  were  still  considered  safe  for 
several  reasons:  Occurrences  of  actual  overload  were  negligible,  the  proba- 
bility of  understrength  was  low,  and  inevitable  detailing  excesses  (design 
conservatism)  existed.  One  additional  reason,  however,  is  most  important  and 
relates  to  the  elastic  analysis.  Until  recently,  the  complexity  of  the  elas- 
tic analysis  encouraged  the  use  of  simplified  assumptions  which  required  up 
to  70  percent,  more  steel  than  would  have  been  required  by  a more  rigorous 
analysis.  The  additional  material,  in  turn,  greatly  increased  the  overload 
capacity  of  the  structure  and  led  Reference  47  to  conclude  with  this  question: 
"With  the  increasing  use  of  computers,  which  make  more  rigorous  analysis,  --- 
will  structures  designed  according  to  ---  (existing  requirements)  ---or  simi- 
lar types  of  loud  system(s)  still  be  adequately  safe?"  This  question  ir. 
equally  applicable  to  the  1.5  factor  of  safety  design  concept  for  air; lanes. 


The  following  are  similar  points  emphasized  in  Reference  ?9.  The  main 
point  emphasized  is  that  the  conventional  factor  of  safety  provides  for 
(unknown)  situations  that  might  not  be  recognized  in  a more  sophisticated 
(rational)  design  procedure.  Any  attempt  to  be  too  sophisticated  can  also 
lead  to  design  procedures  that  are  impractical.  To  avoid  these  possible  pro- 
blems, new  and  old  concepts  should  be  closely  compared.  Any  large  differences 
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in  the  results  should  be  viewed  with  caution  and  not  be  accepted  uncriti- 
cally. It  is  further  noted  that  different  results,  either  more  or  less 
critical,  are  not  necessarily  adverse  and  can  often  be  justified  under  appro- 
priate circumstances. 

The  concluding  question  in  Reference  47  should  also  be  expanded  to 
reliability  based  concepts:  If  more  complex  reliability  based  design  con- 
cepts are  eventually  implemented  to  rationalize  existing  requirements,  save 
airframe  weight  and  improve  performance,  will  the  new  structures  still  be 
adequately  safe?  There  is  no  immediate  answer  available.  Hopefully,  any 
change  in  design  concent  will  bring  with  it  an  adequate  and  equivalent  level 
of  airframe  safety;  however,  any  design  concept  is  a balance  of  requirements 
involving  numerous  parameters  and  design  interactions  and  any  new  concept  for 
which  experience  is  limited  must  be  thoroughly  evaluated  and  closely  moni- 
tored to  ascertain  the  true  affect  of  the  change  on  structural  safety. 

Generally,  reliability  based  concepts  are  not  proposed  to  improve 
flight  safety.  Flight  safety  is  always  a concern  and  new  design  concepts 
are  generally  not  adopted  until  an  equivalent  or  better  level  of  safety  is 
assured.  The  most  significant  reason  normally  given  for  adopting  a new 
concept  is  to  achieve  a reduction  in  weight  when  compared  to  the  accepted 
norm.  This  reason  is  well  intended  but  could  also  be  misleading.  The 
accepted  norm  can  be  elusive  and  difficult  to  define  and  the  projected  sav- 
ings in  structural  weight  can  be  easily  overstated.  Every  design  concept 
attempts  to  maximize  efficiency  and  avoid  either  an  unconservative  or  an 
overweight  structure.  In  this  respect,  current  design  practice  has  been 
very  effective.  Reference  19  provides  some  insight  to  the  history  of  struc- 
tural efficiency  for  bomber  and  transport  airplanes  up  to  1964.  The  obser- 
vation is  that  airplane  weight  trends  and  structural  weight  tractions  are 
very  consistent.  It  makes  no  difference  whether  an  airplane  is  jet  powered 
or  propeller  driven,  whether  it.  was  built  <M>  years  ago  or  is  of  recent  (1964) 
vintage.  There  remains  a balance  between  ai  efficient  structure  and/or 
material  and  the  design  requirements  imposed  on  them.  Studies  of  future 
airplanes  (beyond  1964)  also  supported  this  trend  (which  still  seems  valid 
today).  It  is  apparent  that  if  more  efficient  materials  and  types  of 
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construction  are  found,  that  more  stringent  operational  requirements  will 
be  imposed  on  them.  Time  and  state  of  the  art  advances  seemingly  have  little 
effect  on  basic  structural  weight  trends.  Reference  19  describes  the  weight 
trend  curves  as  basic,  and  as  such,  a technological  breakthrough  would  be 
required  to  significantly  change  them. 

The  trends,  of  course,  are  based  on  the  conventional  factor  of  safety 
design  and  metallic  materials;  any  improvement  in  structural  weight  trends 
that  might  result  from  the  use  of  a reliability  based  design  concept  or  from 
composite  materials  when  used  on  an  actual  airplane  is  unknown.  These  con- 
cepts may  provide  the  necessary  breakthrough.  However,  an  airplane  design 
is  the  result  of  many  compromises  and  interactions  Which  have  a neutralizing 
influence  on  overall  design  with  respect  to  any  one  parameter.  Too  often 
weight  and  performance  improvements  are  estimated  superficially  and  the  opti- 
mistic conclusions  are  not  achievable.  A thorough  study  that  incorporates 
the  major  performance  and  airframe  parameter  interactions  in  a design  eval- 
uation is  required  to  obtain  a confident  weight  impact  assessment  and  many 
design  variations  would  be  required  to  establish  a new  trend.  The  pacing 
influence  on  performance  improvements  to  date  have  come  from  advances  in 
propulsion  concepts,  not  structural  concepts.  Structural  designs  have 
successfully  kept  pace,  however,  and  structural  efficiency  has  improved. 

But  as  pointed  out  in  Reference  19,  when  greater  structural  efficiency  is 
achieved,  greater  demands  are  made  and  the  structural  weight  fraction  has 
not  changed  appreciably. 

The  actual  impact  of  design  data,  analysis,  weight,  and  test  interac- 
tions on  the  development  and  application  of  future  reliability  based  con- 
cepts cannot  be  clearly  defined  at  this  time,  The  similarities  between 
the  factor  of  safety  and  probabilistic  techniques  indicate  that  any  state 
of  the  art  improvements  intended  to  benefit  the  implementation  of  a proba- 
bilistic concept  would  also  benefit  and  improve  the  factor  of  safety  concept. 
This  is  especially  evident  when  considering  a design  data  base  and  may  be 
an  additional  point  to  consider  when  evaluating  changes  in  current  design 
concepts. 
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There  appears  to  be  a slightly  subdued,  but  continuing  interest  with- 
in the  aerospace  industry  to  develop  a design  concept  that  corrects  the 
deficiencies  associated  with  the  factor  of  safety  concept.  It  has  been 
assumed  that  any  lack  of  clarity  in  the  merit,  goals,  or  direction  that 
might  be  associated  with  a reliability  based  concept  will  be  resolved 
satisfactorily  as  the  concept  is  implemented. 

The  remaining  section  will  briefly  suirmarize  the  salient  traits  of 
the  concepts  reviewed  and  project  a possible  balance  in  their  future 
application. 
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SECTION  VII 
CONCLUSIONS  ' 

To  have  emphasized  only  structural  design  concepts  with  respect  to 
flight  safety  is  in  keeping  with  the  intended  scope  of  this  review,  but 
emphasizing  too  limited  a view  could  be  misleading  and  detract  from  other 
important  safety  aspects.  Safety  considerations  in  a broader  view  are 
discussed  in  References  48  and  49  and  serve  as  a reminder  of  the  overall 
scope  of  the  safety  problem.  Safety  is  a total  operational  system  and  all 
aspects  must  be  considered  in  unison. 

The  static  strength  safety  aspects  of  the  airframe  have  been  controlled 
primarily  by  the  1.5  factor  of  safety.  To  be  more  precise,  the  factor  of 
safety  has  been  the  most  visible  design  aspect  of  airframe  safety  and  it 
serves  as  a unit  of  measure  in  that  regard.  It  provides  protection  to 
occupants  from  both  understrength  airframes  and  inadvertent  overloads. 

But  the  overall  concept  of  safety  must  again  be  emphasized  and  not  just 
the  factor  of  safety;  the  factor  does  not  function  alone  but  in  concert 
with  many  other  structural  design  and  operational  requirements. 

The  1.5  factor  of  safety  in  U.S.  design  practice  is  fundamental  and 
represents  a level  of  design  safety  which  has  become  an  accepted  standard. 
Although  the  concept  is  accepted  and  used  without  reservation,  it  has 
remained  in  an  intermittent  state  of  review.  Its  efficiency  as  a design 
concept  has  been  challenged  and  the  objectives  of  its  design  application 
cannot  be  clearly  identified.  There  are  proponents  who  have  encouraged 
change  and  proponents  for  the  status  quo.  To  define  the  arguments  and 
differences  between  them  is  sometimes  difficult. 

Perhaps  the  1.5  factor  of  safety  is  rational  and  does  not  require 
revision.  Or  perhaps  the  1.5  factor  of  safety  is  arbitrary  and  its 
basic  function  cannot  be  defined  sufficiently  to  establish  a revised 
value.  Its  history  seems  to  say  that  the  1.5  factor  of  safety  is  a 
mixture  of  h^th  elements.  The  1.5  factor  is  rational  because  it  is 
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based  on  what  were  considered  to  bo  representative  ratios  of  design  to 
operating  maneuver  load  factors  experienced  during  the  1'K’Os  and  lOJOs 
(which  have  not  appreciably  chained  today)  and  it  is  arbitrary  because 
we  still  do  not  know  the  exact  design,  manufacturing,  and  operating 
intricacies  and  variations  it  protects  against,  or  how  to  quantify  them. 
Neither  can  the  degree  of  In-flight  safety  provided  by  the  1.5  factor  be 
quantified  but  its  successful  history  cannot  be  lightly  dismissed. 

Reliability  and  realism  seem  to  go  together.  Probabilistic  design 
concepts  are  considered  more  realistic  and  have  been  proposed  as  being 
more  rational  than  the  factor  of  safety.  Reliability  based  concepts 
have,  therefore,  been  proposed  to  replace  the  factor  of  safety  concept, 
Because  of  anticipated  Implementation  delays,  interim  design  techniques 
have  been  proposed  and  consist  ot  multiple  factors  of  safety  which  are 
related  to  specific  design  parameters  and  variable  factors  of  safety 
which  are  related  to  specific  design  needs. 

the  primary  justification  and  final  objective  of  the  probalistic 
concept  is  to  improve  airplane  performance  and  reduce  operating  costs. 
Ihese  improvements  are  to  be  gained  through  reduced  airframe  weight. 
However,  recent  airplane  weight  studies  and  past  weight  trends  have 
shown  that  the  actual  airplane  weight  saved  is  often  less  than  antici- 
pated. Purabil it v.  fatigue  life,  and  damage  tolerance  requirements  also 
influence  airframe  weight  and  tend  to  supersede  savings  gained  through 
improved  design  techniques.  These  requirements  add  weight  beyond  that 
needed  for  static  strength. 

There  are  many  design,  operational,  and  possible  legal  ramifications 
to  be  defined  before  the  factor  of  safety  concept  can  be  formally  changed 
with  assured  justification.  Ihe  lack  ot  appropriate  statistical  data, 
the  need  for  procedures  to  establish  the  true  structural  reliability  ot 
a design  and  to  demonstrate  contractual  requirements  will  also  hinder 
implementation  of  a reliability  based  design  concept. 
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Reliability  based  concepts  are  difficult  to  define  and  understand 
In  summary  form  because  of  their  complexity,  but  regardless  of  the 
advantages  or  disadvantages  alluded  to  herein  the  concepts  cannot  be 
lightly  discarded.  They  must,  be  examined  critically  and  objectively, 
simultaneously  defining  the  needed  design  parameters.  Yet,  a completely 
rigorous  reliability  based  concept  nuy  be  so  Impractical  for  structural 
.design  that  it  may  be  less  desirable  than  the  easily  administered  and 
less  rigorous  factor  of  safety  concept.  In  time,  the  application  of 
reliability  based  concepts  to  airframe  design  will  increase  but  the 
degree  of  their  application  may  have  a definite  limit.  Future  concepts 
will  probably  evolve  to  incorporate  both  a simplification  of  the  purely 
statistical  reliability  based  concept  and  the  gross  simplicity  of  the 
factor  of  safety  concept..  The  factor  of  safety  still  covers  many 
contingencies  and  at  this  time  it  appears  there  will  he  a need  for  some 
factor,  and  to  a greater  degree  then  is  sometimes  Implied  (References  ill 
and  ?!>). 

The  objective  has  not  been  to  support  or  minimize  a particular 
structural  design  concept  but  to  underscore  certain  points  seldom 
emphasized.  All  of  the  disadvantages  noted  apply  to  both  the  factor  of 
safety  and  reliability  based  concepts.  The  point  Is,  that  the  reliability 
based  concept  will  not  eliminate  all  of  the  problems  of  the  factor  of 
safety  concept  or  necessarily  offer  a safer  design.  In  fact,  the  problems 
may  tend  to  increase  because  of  limited  design  experience  with  statisti- 
cal concepts  and  the  use  of  statistically  defined  parameters  that  may  be 
of  questionable  validity,  furthermore,  there  may  he  an  unjustified  confi- 
dence in  computed  reliability  estimates  although  reliability  based  design 
concepts  have  been  assumed  to  be  more  rational  than  factor  of  safety 
concepts.  The  physical  results  of  a reliability  based  design  and  the 
related  statistical  data  must  be  more  than  a niathmiat  leal  nicety;  the 
statistical  confidence  expressed  In  the  design  must  be  realizable,  in 
fact,  finally,  regardless  of  the  design  lonrept  adopted  for  future  use, 
the  safety  of  the  airframe  will  depend  not  only  on  that  concept  but  on 
the  adequacy  of  the  total  structural  design  criteria  and  the  ability 
of  the  concept  to  meet  the  proof  ol  compliance  requirements  of  the 
design  specifications  (Reference  ,'•>). 
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